Create charts that are not (necessarily) time-based
The chart command
timechart command, which uses the
_time default field as the x-axis, charts created with the
chart command use an arbitrary field as the x-axis. With the chart command, you use the
over keyword to determine what field takes the x-axis.
Example 1: Use web access data to show you the average count of unique visitors over each weekday.
sourcetype=access_* | chart avg(clientip) over date_wday
One of the options you have is to split the data by another field, meaning that each distinct value of the "split by" field is a separate series in the chart. If your search includes a "split by" clause, place the
over clause before the "split by" clause.
The following report generates a chart showing the sum of kilobytes processed by each
clientip within a given timeframe, split by
host. The finished chart shows the
kb value taking the y-axis while
clientip takes the x-axis. The delay value is broken out by host. After you run this search, format the report as a stacked bar chart.
sourcetype=access_* | chart sum(kb) over clientip by host
Example 2: Create a stacked bar chart that splits out the http and https requests hitting your servers.
To do this, first create
ssl_type, a search-time field extraction that contains the inbound port number or the incoming URL request, assuming that it is logged. The finished search would look like this:
sourcetype=access_* | chart count over ssl_type
After you run the search, format the results as a stacked bar chart.
Create time-based charts
Visualize field value highs and lows
This documentation applies to the following versions of Splunk® Enterprise: 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.0.15, 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.1.14