topic How to plot a timechart from summary index? in Splunk Search

How to plot a timechart from summary index?

splbsm — Thu, 07 Mar 2019 13:02:50 GMT

Hi, I have a summery index with events like this :-

3/06/2019 00:00:00 +0000, search_name=ABCD , search_now=1551916800.000, info_min_time=1551830400.000, info_max_time=1551916800.000, info_search_time=1551916803.490, SourceType="up2date-too_small", date="2019-03-06", info_max_time="1551916800.000", info_min_time="1551830400.000", info_search_time="1551916803.490", info_sid="scheduler_612483161search_RMD5b9c004924d61345e_at_1551916800_2619_CB367A2F-91DF-4379-90F8-63AC41173EAB", sum(b)=960, ABCD, search_name

Now I want to use the date from this event and plot a timechart by sourcetype. Can anyone help me please?

Re: How to plot a timechart from summary index?

nickhills — Thu, 07 Mar 2019 14:15:32 GMT

Give this a go:

[your search]|rename SourceType as original_sourcetype| eval _time=strptime(date, "%Y-%m-%d")|timechart count by original_sourcetype

This assumes you want to timechart them by the date from the summary index

Just as an aside - the rename is probably not necessary, but it helps clarify when you comeback to it in 6months and have forgotten what you did.

Re: How to plot a timechart from summary index?

splbsm — Thu, 07 Mar 2019 15:02:42 GMT

Thank you very much.

Re: How to plot a timechart from summary index?

nickhills — Thu, 07 Mar 2019 15:21:48 GMT

Your welcome!
I updated the title of this question to help others who may be searching in the future!