Tried this and worked beautifully! Thanks! Now I think about it, there is a lightly change the question: how can we implement something that can be continuously move time line using similar way? For example, if the current time line is "-5m to now", what I want is the ability to move the time line to "-10m to -5m", then to "-15m to -10m" etc. (If there were a button available, just like click the button will move 5 minutes earlier on the current selection, click again will move another 5 minutes earlier). ... View more

works great, thanks. ... View more

Sure. Use timechart ! First, some explanation on how timechart behaves: timechart needs some kind of statistical function that returns a unique value for the timespan it's operating on. If you don't define the timespan yourself it will be set dynamically depending on what timerange the whole search spans, but let's take an example where the timespan is 1 minute and that somewhere in your log you have 3 of these events occurring within 1 minute. Splunk needs to know how to give you ONE value for "Value", even though there are 3 values of each. You can tell Splunk to just give you an average from the 3 events using the stats function avg: ... | timechart span=1m avg(Timespent) as Timespent Or, if you only want the values from the first of the events within the time period, use first instead of avg . Want the sum? Use sum . And so on. More information on statistical functions is available here: http://www.splunk.com/base/Documentation/latest/SearchReference/Stats There's also a second way to do this, which is to produce a table containing timestamps and values yourself and then feed them into the chart. ... | table _time Timespent As for the second question, you can achieve this by using bucket to divide Timespend into the intervals you want. Like this: ... | bucket Timespent span=0.5 | stats count by Timespent ... View more

Yes, there is a couple of ways you can do this. Note that your timestamp gets put into a field called _time. If you want to use average figures over a timerange, you can use the timechart function. Eg: search command | timechart avg(pageLoadSeconds) as AvgPageLoadTime If for some reason you want to graph the raw values of pageLoadSeconds, you can just create a table with the values you want, eg: search command | table _time, pageLoadSeconds Note, the graphs in Splunk will only plot up to 1000 events, so if you use the table option you won't be able to do it over a lot of data. It's recommended to use timechart. Either of these can be used to populate a Splunk graph. Cheers, Herbie. ... View more