topic Re: Line Chart over _time by fieldname in Splunk Dev

Line Chart over _time by fieldname

ips_mandar — Tue, 29 Jan 2019 06:26:20 GMT

Hi I am trying below query to plot line chart-

index=abc |eval Time=round(endtime-starttime)|chart values(Time) as Time over _time by Type

Here there can be multiple Type values.
my problem is some _time field has multivalue Time field due to which it is not plotted on graph and I am not able to use mvexpand on Type because Type value is not fixed .
my output looks like below

_time                                     Build
29/01/2019 12:01                            2
                                            3
                                            4
29/01/2019 12:12                            5

from above only 5 value is getting plotted and others are not seen due to multivalue and here I can not apply mvexpand Build as this value can change

Re: Line Chart over _time by fieldname

harishalipaka — Wed, 30 Jan 2019 07:45:30 GMT

hi @ips_mandar
i didn't understand what do u want ,i can't see above example Type

Can u explain what u had and what do u want simply

Re: Line Chart over _time by fieldname

ips_mandar — Thu, 31 Jan 2019 05:43:27 GMT

So Type is fieldname and it's value can be Build or Deploy or both.
After Running this query-

index=abc |eval Time=round(endtime-starttime)|chart values(Time) as Time over _time by Type

I got below results-

_time                                     Build
 29/01/2019 12:01                            2
                                             3
                                             4
 29/01/2019 12:12                            5

But I want to have seggregated result like

_time                                     Build
 29/01/2019 12:01                            2
 29/01/2019 12:01                            3
 29/01/2019 12:01                            4
 29/01/2019 12:12                            5

This can be achieved using mvexpand Build but Build value is not fixed. so is there any other way..

Re: Line Chart over _time by fieldname

DMohn — Thu, 31 Jan 2019 11:28:40 GMT

Have you tried using |filldown _time ??

Re: Line Chart over _time by fieldname

jkat54 — Thu, 31 Jan 2019 12:30:43 GMT

Try the stats command instead

index=abc |eval Time=round(endtime-starttime)|stats values(Time) as Time by _time Type

Re: Line Chart over _time by fieldname

ips_mandar — Thu, 31 Jan 2019 14:03:37 GMT

Thanks for comment @jkat54
but if I try this |stats values(Time) as Time by _time Type|mvexpand Time
i will get below result

 _time                                     Type                              Time
  29/01/2019 12:01                         Build                              2
  29/01/2019 12:01                         Build                              3                  
  29/01/2019 12:01                         Build                              4                  
  29/01/2019 12:12                         Build                              5

and If i plot line chart it will have legend as Time and Type instaead of value of Type i.e. Build
I want result as-

 _time                                     Build
  29/01/2019 12:01                            2
  29/01/2019 12:01                            3
  29/01/2019 12:01                            4
  29/01/2019 12:12                            5

Re: Line Chart over _time by fieldname

ips_mandar — Thu, 31 Jan 2019 14:04:30 GMT

thnks @DMohn but it won't help

Re: Line Chart over _time by fieldname

DMohn — Thu, 31 Jan 2019 14:05:46 GMT

add a |rename Time as Build | fields -Type and you will get your desired result

Re: Line Chart over _time by fieldname

ips_mandar — Thu, 31 Jan 2019 14:19:31 GMT

here for example I shown Build but there can be Build and Deploy under Type