topic Re: Splunk Time chart Line Chart in Dashboards & Visualizations

How to plot time chart line chart?

CodingMaestro — Thu, 09 Mar 2023 19:33:34 GMT

Hello,

So currently I have a trendline like below...

But I need to have the visual in a way where it shows the stats sum(books) for another date which shows the trend of what it was 4 weeks ago for the stats sum (books) and what it is currently, i tried using span but what that does is it shows me how many books for that particular day and not the stats sum(books) in total. I need something like below.. any help would be greatly appreciated.

Re: Splunk Time chart Line Chart

bowesmana — Tue, 07 Mar 2023 23:26:02 GMT

What's your current query?

Re: Splunk Time chart Line Chart

bowesmana — Tue, 07 Mar 2023 23:30:30 GMT

Basically you want to search for both time ranges you are making comparison for, then do something like

| timechart sum(Books) span=1mon | timewrap 1y

to wrap the time periods over a 1year period (I see your example shows a monthly figure for another period - so assume it's a 1y comparison)

Re: Splunk Time chart Line Chart

ITWhisperer — Wed, 08 Mar 2023 07:27:30 GMT

| timechart sum(books) span=4w

Re: Splunk Time chart Line Chart

CodingMaestro — Wed, 08 Mar 2023 09:50:35 GMT

@bowesmana My current query is as below:
| timechart span=24h sum(Books) as Total_Books
| search Total_Books!="null"

Re: Splunk Time chart Line Chart

CodingMaestro — Wed, 08 Mar 2023 09:51:12 GMT

I tried this did not work 😞

Re: Splunk Time chart Line Chart

CodingMaestro — Wed, 08 Mar 2023 09:53:16 GMT

@ITWhisperer Hello, i tried this but the issue with this is that it is not counting the sum(books) as the total it is only counting the sum(books) total for that particular day.,

Re: Splunk Time chart Line Chart

ITWhisperer — Wed, 08 Mar 2023 09:56:02 GMT

Please share the complete SPL you are using when you say it is only counting for a particular day

Re: Splunk Time chart Line Chart

CodingMaestro — Wed, 08 Mar 2023 10:30:02 GMT

the search is running for the last 24 hours..

So i am getting a visual(trendline) that has 524,900 for sum(books)for the last 24 hours but i need a visual that shows the sum(books) every 4 weeks, for the last year. but when i use span=4w for example and have the search run for last year it shows the sum(books) only for that particular day.

Re: Splunk Time chart Line Chart

ITWhisperer — Wed, 08 Mar 2023 11:24:58 GMT

Given

| stats latest(bookName) by id bookNumber _time

Then all the counts given by

| stats dc(bookNumber ) as Books by id _time

will be 1, therefore you just need to count the events from the first stats line by time.

index=..... | stats latest(bookName) by id bookNumber _time | timechart span=4w count

Re: Splunk Time chart Line Chart

CodingMaestro — Wed, 08 Mar 2023 11:47:27 GMT

I cannot really do that as i need the stats sum(books) because for example the books field might have 8, its not always one henceforth that is why i am using stats sum

Re: Splunk Time chart Line Chart

ITWhisperer — Wed, 08 Mar 2023 12:20:39 GMT

Yes, you are right - try this

| stats latest(bookName) by id bookNumber _time | stats dc(bookNumber ) as Books by id _time | table id Books _time | timechart span=4w sum(Books)

Note that the date used will be the start of the 4 week period but still contains the sum of all the days in that period.