need timechart span=1d for 3 fields

splunkuseradmin — Tue, 29 Sep 2020 23:47:09 GMT

Need timechart span=1d for "_time mac ios tab" with stacked bar chart

cdr_events ( globalCallId_ClusterID="AMR" ) earliest=1/1/2019:00:00:00 latest=now()
| sort 0 + dateTimeConnect | eval durationStr=tostring(duration,"duration")
| stats min(_time) as _time list(callingPartyNumber) as callingPartyNumber list(cause_description) as cause_description list(destDeviceName) as destDeviceName list(dest_gateway) as dest_gateway max(_time) as detailLatest list(device_type) as device_type list(duration) as duration list(durationStr) as durationStr list(finalCalledPartyNumber) as finalCalledPartyNumber list(origDeviceName) as origDeviceName list(orig_gateway) as orig_gateway list(originalCalledPartyNumber) as originalCalledPartyNumber by globalCallID_callId globalCallID_callManagerId globalCallId_ClusterID
| search device_type=jabber | rename durationStr as duration
| sort 0 - _time
| fields _time destdevice origdevice

| timechart span=1d count(eval(match(destdevice,"CSF"))) as "CSFA1" count(eval(match(origdevice,"CSF"))) as "CSFB1" count(eval(match(destdevice,"TCT"))) as "TCTA1" count(eval(match(origdevice,"TCT"))) as "TCTB1" count(eval(match(destdevice,"TAB"))) as "TABA1" count(eval(match(origdevice,"TAB"))) as "TABB1" cont=f
| eval CSF=0,TCT=0,TAB=0
| foreach CSF* [| eval Mac=CSF+<>]
| foreach TCT* [| eval iOS=TCT+<>]
| foreach TAB* [| eval TAB=TAB+<>]
| fields _time Mac iOS TAB

I am getting a bar chart but only for mac not for ios and tab. if i try to format y-axis=log and general to side-by-side per day bars are working but not stacked bars

Re: need timechart span=1d for 3 fields

renjith_nair — Sun, 24 Mar 2019 05:03:19 GMT

@splunkuseradmin,

span in timechart splits the data across the time unit you specify and it just depends on _time for timechart .

In your case, if you are able to see the data when you select logarithmic scale, then most probably count for ios and tab considerably low compared to count for Mac (scaling is linear ). You can verify that by looking at the statistics tab. Also the legends on the side of your chart should be visible for all fields.
In addition to that, you can not use logarithmic scaling and stacked chart together. In short, your search is fine, just verify the count for ios &tab

Here is a run anywhere search written in same way as yours

index=_internal earliest=-5m|timechart count(eval(sourcetype=="splunkd")) as splunkd,count(eval(sourcetype=="splunkd_access")) as splunkd_access,count(eval(sourcetype=="splunkd_ui_access")) as splunkd_ui_access

topic Re: need timechart span=1d for 3 fields in Dashboards & Visualizations

need timechart span=1d for 3 fields

Re: need timechart span=1d for 3 fields