Dashboards & Visualizations

Simple(?) realtime chart example

chadroberts
Path Finder

I'm trying to figure out how real-time charts are built and so far I've had zero success. Even doing something like creating a line chart with 'host=* | stats count' to show event counts over time isn't working. Is this something that can be done with simple XML or do I have to switch to advanced xml?

Tags (2)
0 Karma
1 Solution

Ron_Naken
Splunk Employee
Splunk Employee

Try your search a little different. Select in the time picker -- the green button to the right of your search bar -- that you want one of the real-time ranges. Then do your search like this:

host=* | chart count

Then click the "Build Report" button on the right by the time picker, once you have some data showing up. An easier method is to go into "Advanced Charting & Reporting" on the View menu to run your chart/timechart searches.

You might find the following tutorial of value. It will walk you through how to build charts and dashboards:
http://www.splunk.com/base/Documentation/4.2.1/User/WelcometotheSplunkTutorial

Cheers

View solution in original post

Ron_Naken
Splunk Employee
Splunk Employee

Try your search a little different. Select in the time picker -- the green button to the right of your search bar -- that you want one of the real-time ranges. Then do your search like this:

host=* | chart count

Then click the "Build Report" button on the right by the time picker, once you have some data showing up. An easier method is to go into "Advanced Charting & Reporting" on the View menu to run your chart/timechart searches.

You might find the following tutorial of value. It will walk you through how to build charts and dashboards:
http://www.splunk.com/base/Documentation/4.2.1/User/WelcometotheSplunkTutorial

Cheers

Ron_Naken
Splunk Employee
Splunk Employee

You could simplify the syntax for that search, using timechart: host=* | timechart by sourcetype. When no data is coming in, the chart should still update, as long as you have a real-time range selected. The "null values" combo box has a selection to treat null/missing data as 0 or to connect it to the next value.

chadroberts
Path Finder

Thanks, that definitely put me in the right direction. The only issue I seem to have now is that zero values don't factor into the charting. The search I'm playing with is:
host=*|chart count by _time,sourcetype
Which in my case shows me counts for linux_audit and WinEventLog::Security, however for periods where no data is coming in the chart doesn't update, and leaves the previous non-zero count until a new non-zero number shows up. Is there a way to avoid this behavior?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...