Splunk Search

Actual and avg values on one timechart

lain179
Communicator

I would like to draw a line time chart that shows both real values and avg values of Search Time.

When I do timechart avg(SearchTime) values(SearchTime) only avg works.

When I do table _time "SearchTime" only real values show.

How can I put them together on a chart?

Thanks!

Tags (1)
0 Karma
1 Solution

Ayn
Legend

If you use timechart and want to put its results in a graph, you need one value per time slice. If you want more values, change the timespan. The output from values() cannot be consumed by the chart (how would it know where to put which value?)

View solution in original post

0 Karma

Ayn
Legend

If you use timechart and want to put its results in a graph, you need one value per time slice. If you want more values, change the timespan. The output from values() cannot be consumed by the chart (how would it know where to put which value?)

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...

Updated Data Management and AWS GDI Inventory in Splunk Observability

We’re making some changes to Data Management and Infrastructure Inventory for AWS. The Data Management page, ...