topic Re: How can I visualise at what time a daily event happened during the last month? in Dashboards & Visualizations

How can I visualise at what time a daily event happened during the last month?

enricopolini — Fri, 08 Dec 2017 08:17:15 GMT

I have an event that should occour every day, I would like to visualise a a chart where I can see over the last month at what time of the day that event occurred (if it did occour)
Many thanks

Re: How can I visualise at what time a daily event happened during the last month?

mayurr98 — Fri, 08 Dec 2017 08:44:04 GMT

Hi
Daily event can we be extracted and give a field name as "daily_event"
Thereafter you can write below query:

index=<your_index>  daily_event=*  | stats count by daily_event,  _time

Re: How can I visualise at what time a daily event happened during the last month?

niketn — Fri, 08 Dec 2017 08:56:55 GMT

If you are on Splunk Enterprise 7.0, you should check out Event Annotation.

https://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartEventAnnotations