I'm looking to create a multi-series scatter plot where time is on the x-axis.
An example would be something like this:
![alt text][2]
Attempts to do this in splunk are failing. Given the format requirements: ... | table marker_name_field x-axis_field y-axis_field
In the first attempt, using _time, all points are assigned an x-value of 0, like splunk can't understand the timestamp in its native/textual format. (see example below)
Using the timestamp in epoch format works in that it will correctly display points along the x-axis, but having a timestamp in that format is not human interpretable, so is not particular useful or viable as an option. (see example below)
![alt text][3]
Short of using D3 to create a custom viz, is there something I'm missing, or are Splunk's native viz capabilities unable to create this kind of chart?
[1]: /storage/temp/187332-time-scatterplot-splunk-fail.jpg
[2]: /storage/temp/187329-time-scatterplot-example.jpg
[3]: /storage/temp/187331-time-scatterplot-splunk-fail.jpg
↧