Splunk Search

How to display a chart with raw data?

jangid
Builder

How to display a chart with raw data

e.g.

mysearch | table MyCount | timechart MyCount
or
mysearch | table MyCount | chart MyCount by _time

I don't want to calculate avg/count etc... just want to create a chart with whatever data I have

Thanks

Tags (1)
1 Solution

twkan
Splunk Employee
Splunk Employee

You can try values(MyCount), e.g.

mysearch | table MyCount, _time | chart values(MyCount) by _time

View solution in original post

Ayn
Legend

If you're going to use timechart, you simply NEED to provide it with a statistical function. The reason for this is that timechart operates on timespans in which it puts events. In order to guarantee it calculates just ONE unique value per timespan, it needs a way of calculating it - a function. If you don't define the timespan yourself it will be set dynamically depending on what timerange the whole search spans, but let's take an example where the timespan is 1 minute and that somewhere in your log you have 3 events occurring within 1 minute. timechart then needs to know how to give you ONE value for "MyCount", even though there are 3 values of each. You can tell Splunk to just give you an average from the 3 events using the stats function avg:

mysearch | timechart avg(MyCount)

Or, if you only want the values from the first of the events within the time period, use first instead of avg. Want the sum? Use sum. And so on. More information on statistical functions is available here: http://www.splunk.com/base/Documentation/latest/SearchReference/Stats

There's also a second way to do this, which is to produce a table containing timestamps and values yourself and then feed them into the chart.

mysearch | table _time MyCount

This is an easy approach should give you what you want. The possible caveat is that if you have lots of values for MyCount returned from your search, you'll get more datapoints than what you can feed a chart with.

twkan
Splunk Employee
Splunk Employee

You can try values(MyCount), e.g.

mysearch | table MyCount, _time | chart values(MyCount) by _time

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...