topic Re: Divide by quarter in Dashboards & Visualizations

Divide by quarter

appleman — Mon, 17 Mar 2014 08:50:30 GMT

Hello,

In my search, I configured time as the following format %Y%m to see the trends every month over a year.
If I want to count by quarter since I can't see the time(date) how do I define it? (timerange is set "alltime")
Additionally, if it's possible, I want to add a custom timerange picker to pick each quarter, so I want to know if I can do it in splunk 6 dashboard.

Thank you.

「年/月」と定義した時間をタイムチャートで表示した時、情報量が多くて時間が隠れてしまいます。
これをクウォーターごとに区切ってカウントしたい場合はサーチ文で分割することは可能でしょうか。タイムレンジは傾向が見たいので、なるべく全時間をしても綺麗に結果が出せるようにしたいです。

尚、クウォーターが選択できるカスタムタイムレンジピッカーをsplunk6で作成する方法はございますでしょうか。

My search: index=mdm source=*idm_device cid=* | eval enrolled=strftime(enrolled_date, "%Y/%m") | chart count by enrolled_type

Re: Divide by quarter

melonman — Mon, 17 Mar 2014 10:38:06 GMT

Could you try this?

<your filter search> | timechart span=3mon count by enrolled_type

Re: Divide by quarter

appleman — Mon, 17 Mar 2014 11:04:56 GMT

I've got this result. Unfortunately, this is not what I want....

Re: Divide by quarter

appleman — Mon, 17 Mar 2014 11:05:19 GMT

I've got this result. Unfortunately, this is not what I want....

Re: Divide by quarter

melonman — Mon, 17 Mar 2014 11:13:40 GMT

how would you like to display? could you help me understand?

Re: Divide by quarter

appleman — Mon, 17 Mar 2014 11:18:37 GMT

The result above is missing 2011 through 2012 data while I could see them if I didn't divide by span=3mon.
And what I want to try most is show x axis as like "2011-Q1", "2011-Q2".... and so on.

Re: Divide by quarter

melonman — Mon, 17 Mar 2014 11:36:00 GMT

Oh, that's because there is no data? so you have data for 2011 - 2012 but there is no result for timechart span=3mon count?

Re: Divide by quarter

appleman — Mon, 17 Mar 2014 11:45:05 GMT

Yes, that's correct.

Re: Divide by quarter

somesoni2 — Mon, 17 Mar 2014 15:19:31 GMT

Try this

index=mdm source=*idm_device cid=* | eval enrolled=strftime(enrolled_date,"%Y")."-Q".(round(tonumber(strftime(enrolled_date,"%m"))/3)+ 1) | chart count by enrolled

Re: Divide by quarter

eashwar — Wed, 02 Apr 2014 19:37:03 GMT

Hello Brother,

Its very simple and straight forward

| timechart span=qtr count by enrolled_type

If you need to view a report for exactly last 6 quarters

in the advance time range set the below

earliest=-6qtr@qtr latest=-qtr@qtr

Thanks, and Happy splunking bro !!

Vote for the answer if it really helps you, thanks again