how to draw a simple graph of response times against _time

[edookati]

I need to draw a simple graph of all the response times for a particular service in my application. I am using the below query for now, but i do not want average. I want all the response times on 'y' and _time on 'x' and the graph showing them. There are more than 1 call per second and avg doesn't actually represent the issue we are trying to resolve.
Thanks a lot.

index=jms_logs sourcetype=perflogs operation_name="RSA*" | timechart span=1s avg(response_time)

[MuS · Accepted solution]

Hi edookati,

you can use either list or values within the timechart but if you really have multiple results within one second the graph could look strange. Nevertheless try something like this:

index=jms_logs sourcetype=perflogs operation_name="RSA*" | timechart span=1s list(response_time)

or

index=jms_logs sourcetype=perflogs operation_name="RSA*" | timechart span=1s values(response_time)

list will bring back all values and values only the distinct values for all events, see the docs for more details http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/CommonStatsFunctions

cheers, MuS

[edookati]

Pretty close to my requirement and thanks a lot. This will do for now 🙂