topic Re: Need help in creating a pie chart or any visualization show last 6 months and 12 month in Splunk Enterprise

Creating a pie chart or any visualization show last 6 months and 12 month?

Keerthi — Wed, 24 May 2023 14:24:31 GMT

Hi All,

This is the existing visualization which has Lastlogon(people who haven't logged in for quiet sometime). Those record which has null lastlogon value is done a count. I have requirement here to show value for last 6 month and 12 months. Can anyone help me in providing the command for last 6 months and 12 months

Re: Need help in creating a pie chart or any visualization show last 6 months and 12 month

ITWhisperer — Wed, 24 May 2023 10:39:17 GMT

Just extend your timeframe for your search to 6 months, then 12 months - assuming you have the data going back that far!

Re: Need help in creating a pie chart or any visualization show last 6 months and 12 month

Keerthi — Wed, 24 May 2023 11:37:32 GMT

How to show both last 6 and last 12 months together in a single visualization?

Re: Need help in creating a pie chart or any visualization show last 6 months and 12 month

ITWhisperer — Wed, 24 May 2023 11:48:14 GMT

Just set a field with a value which represents which time segment it comes from and use that in your visualisation.

Re: Need help in creating a pie chart or any visualization show last 6 months and 12 month

Keerthi — Wed, 24 May 2023 12:20:42 GMT

you explain with an example for the command please

Re: Need help in creating a pie chart or any visualization show last 6 months and 12 month

ITWhisperer — Wed, 24 May 2023 12:25:10 GMT

| eval period=case(_time > relative_time(_time,"-6mon@d"),"6months",_time > relative_time(_time,"-1y@d"),"12months")