topic Re: chart with two lines in Dashboards & Visualizations

chart with two lines

hunyady — Tue, 15 Sep 2015 14:05:05 GMT

Hallo,
I will make a chart with two lines. I have a query : select a,b,eventtime from t. Eventtime is the datum and time in a char field :"2015-09-11 03:00", for all 15 Minutes there is one record. I will show the values 'a' and 'b' for the last 7 days (i.ex). How can I make it ?
thank you

Re: chart with two lines

woodcock — Tue, 15 Sep 2015 15:36:46 GMT

Maybe like this (set timepicker for Last 7 days😞

... | timechart span=15m avg(a) AS a avg(b) AS b

Re: chart with two lines

hunyady — Tue, 15 Sep 2015 15:51:54 GMT

yes, now I have more lines with timestamp of 15 min, but both 'a' and 'b' are empty. Have tried 'avg', 'max'. Result is the same. Empty result by values.

Re: chart with two lines

woodcock — Tue, 15 Sep 2015 16:02:52 GMT

Show us one of your raw events.

Re: chart with two lines

hunyady — Wed, 16 Sep 2015 06:38:48 GMT

15.09.15 08:30:00,000

"2015-09-15 08:30:00" A=3399, B=5025, EVENTTIME="2015-09-15 08:30:00"

EVENTTIME = 2015-09-15 08:30:00
A = 3399
B = 5025
host = myhost
source = My_Logs
sourcetype = mylogs

I have 940 rows ...

Re: chart with two lines

Amohlmann — Wed, 16 Sep 2015 08:00:40 GMT

Would something like this work for you:

basesearch|earliest=-7d| timechart values(A) as A, values(B) as B

The only thing to note is that it will not like it if you have multivalues.
If this still does not provide anything, do a quick

stats values(a) as, values(b) as b by _time

just to see whats going on which might help you out. Could it be that it does not realize that EVENTTIME is the timestamp?
if you do not want to worry about configuring that could you just do something like this as a work around:

basesearch|| stats values(A) as A, values(B) as B by EVENTTIME

Re: chart with two lines

woodcock — Wed, 16 Sep 2015 08:59:17 GMT

I see the problem; field names are case-sensitive! This will work:

... | timechart span=15m avg(A) AS A avg(B) AS B

Re: chart with two lines

hunyady — Wed, 16 Sep 2015 09:34:52 GMT

Thank you very much !!!
It was the problem ...

Re: chart with two lines

hunyady — Wed, 16 Sep 2015 11:36:03 GMT

Hi, new problem.
Have records from 11-Sept until now. In our Oracle-Database I have all records, 4 records pro hour: eventtime for all 15 Min.
In Splunk missing for ALL DAY the events between 12:00 - 12:45, We have events until 11:45 and after 13:00.
Can you have an idee, why ?
Field "Eventtime" is always generated with sql: to_char(eventtime,"yyyy-mm-dd hh24:mi:ss")
Have only tried the index new to generate (deleted, new created). All records new loaded. Missing 12:00-12:45.
Thank you

Re: chart with two lines

woodcock — Wed, 16 Sep 2015 12:13:37 GMT

I do not understand (your language is hard to follow). You should probably create a new question and start over and try to spell out ALL of the details.