I want to use timechart as instead of sparkline.
index=test | table A B C D | join A [ search index=test |
Do you have any suggestions?
Thanks.
Add _time to your table.
Thank you for answering. But,I would like to have a way like tableau.
Can you share a link or a screenshot of what you mean?
Thank you for contacting.
Could you check it because I added a screenshot?
Try this
index=test |timechart max(A) max(B) max(C) max(D)
I appreciate your suggestion.
It is displayed in one figure, it is easy to see, but this time I want to display it separately.
Do you want help with post Processing to run single base search for table and timechart? While displaying can you display timechart on click of a particular table row? If yes please check out Table Row Expansion (More Details) and In-Page Drilldown with Perma-linking examples in Splunk 6.x Dashboard Examples app
Thank you. I am glad your reply.However, I made that setting.It can display only one graph.I would like to have a way like tableau.Best regards.