topic Re: charting time - using time within a lookup in Splunk Search

charting time - using time within a lookup

brdr — Thu, 24 May 2018 17:58:01 GMT

I have a lookup file with about 100K events. What I want to do is use timechart (span each day). There is a time field in the lookup called '_time'. I have:

| inputlookup mylookup.csv
| timechart span=1d sum(count)

Can I do this?

Re: charting time - using time within a lookup

somesoni2 — Thu, 24 May 2018 18:25:13 GMT

You can use timechart command as long as _time field in your lookup has date in epoch format. You can use sum(count) if there is a field count exists in the lookup.

Re: charting time - using time within a lookup

brdr — Tue, 29 Sep 2020 19:37:44 GMT

This is what I have. I do have a field called 'count' in my lookup that I don't care about. Here is my search:

| inputlookup mylookup.csv 
| convert timeformat="%Y-%m-%dT%H:%M:%S" mktime(_time) as _time
| rename count as count_c
| timechart span=1d sum(count) as Daily_Total

I see that _time is display the days, but Daily_Total is NULL (blank)??

Re: charting time - using time within a lookup

somesoni2 — Thu, 24 May 2018 19:15:12 GMT

So what you want your query to do, show count of entries in the lookup per day or sum of some field's value? If you just want to see how many entries falls into a day, just use function count (no need to specify a field if just counting events).

 | inputlookup mylookup.csv 
 | convert timeformat="%Y-%m-%dT%H:%M:%S" mktime(_time) as _time
 | timechart span=1d count as Daily_Total

Re: charting time - using time within a lookup

brdr — Thu, 24 May 2018 19:57:31 GMT

ah man... thank you somesoni2!

Re: charting time - using time within a lookup

niketn — Fri, 25 May 2018 07:57:49 GMT

@brdr if your issue is resolved, do accept the answer to mark this question as answered.