topic Re: Couldn't get the timings on barchart using chart in Splunk Enterprise

How to get the timings on barchart using chart?

fahimparvez02 — Thu, 05 Jan 2023 21:16:46 GMT

Please help me to show the timings on below barchart, i am using chart count over by description to view the file name on graph when i point the mouse pointer to chart, but i couldn't able to provide the timings on xaxis , below are the query and graph

index=xxxxx sourcetype = xxxx source="xxxxxx_*.log" |eval description=case(Suspend Like "S","Suspended",Suspend Like "P","Partially-Completed",Suspend Like "C","Completed")|eval File_Name= description."-".TC_File_Name|table _time File_Name TC_File_Name description |chart count(File_Name) over TC_File_Name by description

Re: Couldn't get the timings on barchart using chart

matt8679 — Wed, 28 Dec 2022 17:23:08 GMT

Hi,

Click Format > Chart Overlay > in overlay, click and select field > View as Axis "On"

That might give you want you want.

Re: Couldn't get the timings on barchart using chart

ITWhisperer — Thu, 29 Dec 2022 07:18:50 GMT

The chart will use 3 things to display, the x-axis, the y-axis and the series. In your case, the x-axis is the TC_File_Name, the series are the descriptions, and the y-axis is the count of combinations of descriptions and TC_File_Name, for each TC_File_Name. Time does not figure in any of these. Therefore, with your current search, you will not be able to show time. Which of the dimensions do you want to remove so that time can be shown?

Re: Couldn't get the timings on barchart using chart

fahimparvez02 — Fri, 30 Dec 2022 04:26:18 GMT

Thanks for your input, i tried to change as you said but is it possible to display the field Suspended-TC57* with red color ? please help me on that

index= XXXX source="*.log" | eval description=case(Suspend Like "S","Suspended",Suspend Like "C","Completed",Suspend Like "P","Partially-Completed")|eval newField= description."-".TC57_File_Name|timechart span=1h useother=f limit=0 count by newField|sort by newField.

for the below question, i am trying to display the file name with status on it when we point the mouse over the bar, also i need to display the timings on xaxis, please help me with either one of the above or below dashboard which ever works would be highly appreciated.

Re: Couldn't get the timings on barchart using chart

fahimparvez02 — Thu, 05 Jan 2023 01:38:58 GMT

Can anyone please help on this?