All Apps and Add-ons

Using Timewrap to show the last X weeks of daily data, why is a linechart only showing dots instead of lines?

HattrickNZ
Motivator

I am trying to show daily values for the last x weeks, using the timewrap command to overlap the weeks (i.e. weekX, weekX-1,...)

The line chart is not showing lines, it is just showing the dots. Not sure if this is an issue or my issue. Can anyone advise? maybe my search is incorrect?

This is my search:

index=core .... earliest=-5w@w1 latest=+w@w1 | timechart span=d sum(c140509343) as "kpi1" | timewrap w series=exact

Below is what I am getting:

alt text

EDIT1
using the answer below makes the lines join up. however if i seleect a column chart, the date order of the values are not correct. For example if i look at wednesday below I get the following order from left to right (hopefully it is clear in the picture)
wednesday from week beginning sep20th
wednesday from week beginning sep13th
wednesday from week beginning sep06th
wednesday from week beginning aug30th
a gap
wednesday from week beginning oct05th
wednesday from week beginning sep28th

Ideally I would like these to be left to right, oldest date to newest.

alt text

0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

The "problem" here is that you don't have the data in between the points. So, it doesn't "connect" the dots. You can "force" it, by editing the visual format and choosing the option to connect the lines for null values.

alt text

View solution in original post

alacercogitatus
SplunkTrust
SplunkTrust

The "problem" here is that you don't have the data in between the points. So, it doesn't "connect" the dots. You can "force" it, by editing the visual format and choosing the option to connect the lines for null values.

alt text

HattrickNZ
Motivator

tks,see my edit1 above which hopefully explains it better.

0 Karma

HattrickNZ
Motivator

tks got it to work but just after noticing that it does not sort the dates left to right for each daily value. it would be good if I could control this ordering?

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Can you put an example of what you are referring to?

0 Karma

HattrickNZ
Motivator

if i change the span=d to span=h a line chart is drawn normally with lines and dots.

0 Karma
Get Updates on the Splunk Community!

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...