splunk report

[rameshlpatel]

Hi,

I have timeDif values(Time diffrence between start and stop) which I want to point in chart with time period.

please help me.

[jhowkins]

Take a look at the solutions I've provided below. Let me know if that works for you.

[jhowkins]

I suspect you're only getting single points on the linechart but they are not connected. If this is the case, try the following;

Assuming you've already set your chart type to "Line"...
- Click "Format" to the upper left of the chart on the Visualization tab
- From the General tab, click the "Connect" button (right-most) next to "Null Values"
- Click Apply and your linechart will have connected dots

If your events are not continuous, you could also acheive the same thing by setting cont=f ...

... | timechart cont=f avg(timeDiff)

I've made some assumptions here. Hopefully I answered your question -- if not, I'd need more detail... a screenshot is always nice.

[martin_mueller]

Does that field contain numeric values?

Posting some sample data would indeed make it a lot easier than stabbing in the dark.

[rameshlpatel]

index="OCSDEV" | timechart avg(timeDiff)

Here timeDiff ( in milliseconds) is field I am extracting from the logs.

[somesoni2]

Could you please share your current query and sample output of that query? It would be lot easier to provide suggestion if we can see what you see.

[martin_mueller]

So..... something like this?

base search | timechart avg(milliseconds)

Set the visualization to line charts.

[rameshlpatel]

Yes I am doing..

[martin_mueller]

Make sure you're using the correct field name in the avg(fieldname) call.

[rameshlpatel]

Its not showing any line in chart

[martin_mueller]

In what way?

[rameshlpatel]

Thanks for your answer,I tried but its not working.

[rameshlpatel]

I have the values(milliseconds) which I am getting from logs. In chart In X axis=Time period and in Y axis=milliseconds.

In this i need line chart which goes up and down based on milliseconds value coming from logs.

[martin_mueller]

Do elaborate more on your data and the desired results.