Splunk Search

timechart response time from proxy servers

rstrong30
Loves-to-Learn

I simply need to timechart the numeric values from field that is being returned.  For example

index=proxy | timechart count by resp_time.  getting something like this:

rstrong30_0-1692910131946.png

I need one line that charts all the values... instead it splits them up by how many times it has seen each value.

Labels (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

If there are multiple values for the same time, what do you want to show on that single line?

You are splitting by value, so instead just do

index=proxy 
| timechart max(resp_time)

or you could use avg() or some other aggregation. 

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...