Splunk® Enterprise

Search Tutorial

Download manual as PDF

Splunk Enterprise version 7.0 is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
Download topic as PDF

Create a report from a custom chart

In this example, you create a report that charts which products were purchased over a period of time. This example uses the timechart command and chart options to create and customize a chart.

This example requires the productName field from the Enabling field lookups section. You must complete all of those steps before continuing with this section.


  1. Start a new search.
  2. Run the following search.

    sourcetype=access_* | timechart count(eval(action="purchase")) by productName usenull="f" useother="f"

    This search uses the count() function to count the number of events that have the field action=purchase.

    The search also uses the usenull and useother arguments to ensure that the timechart command counts events that have a value for productName.

    The following table appears on the Statistics tab.

    This screen image shows the result of the search. The first column contains dates, based on the event timestamp. The remaining column labels list the names of each product.  For each date and product, the cells display a count of the number of products purchased.

  3. Click the Visualization tab.
  4. In the Format drop-down list, format the X-Axis, Y-Axis, and Legend to produce the following Line chart.

  5. This screen image shows the following changes to the chart. The chart type is "line". The X-Axis contains a custom title "Date" and the labels are at a -45 degree angle. The Y-Axis contains a custom title "Purchases" and an Interval of 10.  The legend is positioned at the top of the chart.

    This table lists the changes made to the chart.

    Chart changes Setting or value
    Chart type Line
    X-Axis CustomTitle Date
    X-Axis Labels -45 degree angle
    Y-Axis Custom Title Purchases
    Y-Axis Interval 10
    Legend Position Top
  6. Click Save As and select Report.

    This screen image shows the updated Save As drop-down.
    1. In the Save Report As dialog box, for Title type Product Purchases over Time.
    2. For Description, type The number of purchases for each product.
    3. For Content, select Line Chart and Statistics Table.
    4. For Time Range Picker, keep the default setting Yes.
  7. Click Save.
  8. In the confirmation dialog box, click View to see the report.
    This screen image shows the saved report.

Next step

Create a report from a sparkline chart

See also

timechart command in the Search Reference
Chart overview in Dashboards and Visualizations
About reports in the Reporting Manual

Last modified on 26 March, 2018
Create an overlay chart and explore visualization options
Create a report from a sparkline chart

This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters