How to format splunk graphs to show multiple lines (one line for each method)?

user_9685730 0
Viewed 337

I am new to splunk reports, I am trying to achieve the following: I want to generate splunk logs report (graphical) for API performances with execution time on x-axis and method names on y-axis. I am trying to run following query:

cs_dataowner_id="ICTO-31263" cs_stage =  UAT 
| search cs_component_id="icomply-gpat-api-buslogs" 
| search Action=API_PERFORMANCE 
| table Message Execution_Time 
| sort by Execution_Time desc

Expected line graph should show a single line for each method (API) expanding with time on x axis hence number of lines on y-axis should be equal to number of apis/methods called in that time range.

Current output: A single line on y axis for all the methods (here I have 2 apis).

I tried all the formatting options but nothing worked.

Screenshot: enter image description here

splunk-formula splunk
1 Answers

Instead of piped search commands, do it all on the first line:

cs_dataowner_id="ICTO-31263" cs_stage=UAT cs_component_id="icomply-gpat-api-buslogs" Action=API_PERFORMANCE

Instead of the sort and table commands, use chart:

| chart count(Message) as Messages over Execution_Time by Message

This command graphs the number of calls to each API with Execution_Time on the X-axis and separate lines for each API (Message).

user_22274200
Related