Creating Line Charts

Line charts are two dimensional but, quite like the pie chart and the bar chart, are capable of using context menus. Lets see some examples of line charts.


In the above example, we are creating a standard line chart that gives us a distribution of users hitting our website, grouped by countries. The query function we use will first find all http 200 events in webserver logs and then aggregate them by country.

_fetch * from event where $Duration=24h AND $LogType=WEBSERVER AND $EventID=200 limit 1000
>>_agg count_unique $SrcCN
>>_sort by count_unique DESC
  • Let’s give our widget a “Name”
  • Next, pick “Line Chart” from the “Chart Type”
  • Then choose $SrcCN as your “Primary Key” and pick count_unique as your “Value”
  • Hit “Update Chart” to see your visualization

Line charts have been traditionally used to visualize timelines. This example below shows you how.


So, in the example above, we have modified our query function a little and plotted all the successful requests over the last 24hours. The visualization uses the timeslice feature of the _fetch directive which is directed to group all the results into buckets of 2 hours.

_fetch * from event where $Duration=24h AND $LogType=WEBSERVER AND $EventID=200 group timeslice 2h limit 100

Let’s try another one.

  • Give your widget a “Name”
  • Pick “Line Chart” from the “Chart Type” options
  • Here’s the difference. Pick $CNAMTime (default time) as our “Primary Key” and choose count as the “Value”
  • Hit “Update Chart” to see your visualization

And with that, you’re ready to experiment more with line charts!