Take a look at the solutions I've provided below. Let me know if that works for you.
I suspect you're only getting single points on the linechart but they are not connected. If this is the case, try the following;
Assuming you've already set your chart type to "Line"...
- Click "Format" to the upper left of the chart on the Visualization tab
- From the General tab, click the "Connect" button (right-most) next to "Null Values"
- Click Apply and your linechart will have connected dots
If your events are not continuous, you could also acheive the same thing by setting cont=f ...
... | timechart cont=f avg(timeDiff)
I've made some assumptions here. Hopefully I answered your question -- if not, I'd need more detail... a screenshot is always nice.
Does that field contain numeric values?
Posting some sample data would indeed make it a lot easier than stabbing in the dark.
index="OCSDEV" | timechart avg(timeDiff)
Here timeDiff ( in milliseconds) is field I am extracting from the logs.
Could you please share your current query and sample output of that query? It would be lot easier to provide suggestion if we can see what you see.
So..... something like this?
base search | timechart avg(milliseconds)
Set the visualization to line charts.
Yes I am doing..
Make sure you're using the correct field name in the avg(fieldname)
call.
Its not showing any line in chart
In what way?
Thanks for your answer,I tried but its not working.
I have the values(milliseconds) which I am getting from logs. In chart In X axis=Time period and in Y axis=milliseconds.
In this i need line chart which goes up and down based on milliseconds value coming from logs.
Do elaborate more on your data and the desired results.