# Splunk vs Elastic Timechart \[Line/area\]

**URL:** <https://discuss.elastic.co/t/splunk-vs-elastic-timechart-line-area/175184>\
**Category:** Kibana\
**Created:** [April 3, 2019, 11:52am UTC](https://discuss.elastic.co/t/splunk-vs-elastic-timechart-line-area/175184 "2019-04-03T11:52:27Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ravitandur](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ravitandur/32/4568_2.png) [@ravitandur](https://discuss.elastic.co/u/ravitandur)\
**Post date:** [April 3, 2019, 11:52am UTC](https://discuss.elastic.co/t/splunk-vs-elastic-timechart-line-area/175184/1 "2019-04-03T11:52:27Z")

</div>

We are migrating from Splunk to ELK. During this migration, I was transforming Splunk time chart into Kibana area chart. I found below basic difference between splunk and Elastic implementation for this. I am explaining the difference in this topic. Can someone please tell me is it possible to get area chart similar to Splunk?

In Splunk the query is like below:

\*\*index=f5\_access \*\*  
\*\*| eval length = len(uri) \*\*  
\*\*| eval urlall = split(uri, "?") \*\*  
\*\*| eval url = mvindex(urlall, 0) \*\*  
**| timechart count(url) by url**

Which results into below visualisation. Please note that whatever time range we select, at any bucket [data point] graph always shows the top 10 same URLs and will not change for each data point. So throughout the timeframe we see only top 10 URLs.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/6/a69e6e677620a471737260a2b4d70dc46fabf4d1.png)

I created similar visualisation in Kibana as shown below.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/6/e682a2df286e45a7850b1134c6124939cd419489.png)

which resulted into below graph:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/4/f48fa719f4c6ba9bc63f344646ad784fd4c3166f.png)

Is it possible to get overall top 10 URLs listed throughout the graph instead of per bucket top URLs in elastic. Please suggest how to get similar behaviour in Elastic and Kibana.

Thanks,  
Ravi

---

<div class="post-metadata">

**Author:** ![Bill\_McConaghy](https://avatars.discourse-cdn.com/v4/letter/b/ed655f/32.png) [@Bill\_McConaghy](https://discuss.elastic.co/u/Bill_McConaghy)\
**Post date:** [April 3, 2019, 1:21pm UTC](https://discuss.elastic.co/t/splunk-vs-elastic-timechart-line-area/175184/2 "2019-04-03T13:21:17Z")

</div>

I think you can just reverse the order of the aggregations on the x-axis, similar to this:

 ![23](https://us1.discourse-cdn.com/elastic/original/3X/d/8/d8fba5bd377561e0e2f5f5d22a0bf1b245977b23.png)

---

<div class="post-metadata">

**Author:** ![ravitandur](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ravitandur/32/4568_2.png) [@ravitandur](https://discuss.elastic.co/u/ravitandur)\
**Post date:** [April 10, 2019, 9:42am UTC](https://discuss.elastic.co/t/splunk-vs-elastic-timechart-line-area/175184/3 "2019-04-10T09:42:45Z")

</div>

Thank you. able to resolve the problem with you suggestion.  
I missed aggregation order part.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 8, 2019, 9:42am UTC](https://discuss.elastic.co/t/splunk-vs-elastic-timechart-line-area/175184/4 "2019-05-08T09:42:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.