topic Re: Display time graph based on peak events over time || based on the log occurence i need to plot the graph over time in Splunk Search

Display time graph based on peak events over time || based on the log occurence i need to plot the graph over time

d942725 — Wed, 30 Sep 2020 04:16:57 GMT

I have a use case where i need to plot the time graph, which shows the events count based on time. I must be able to see the graphical view of spike in the events I receive over time. I have some log similar to the one mentioned below:
{
@timestamp: 2020-02-04T13:46:41.274+00:00
domain: test
environment: dev
level: INFO
logger_name: com.test.practice.evthub.sse.impl.EventEncrypter
message: Published records to Kinesis stream
thread_name: main
}

Query: domain="test" environment="dev" logger_name="com.test.practice.evthub.sse.impl.EventEncrypter" message="Published records to Kinesis stream"|stats count by message
I tried using timechart function by passing the message as input but was getting some tabular format instead of graph plots. Can someone help me to do this query ?

Re: Display time graph based on peak events over time || based on the log occurence i need to plot the graph over time

to4kawa — Tue, 18 Feb 2020 10:21:17 GMT

domain="test" environment="dev" AND logger_name="com.test.practice.evthub.sse.impl.EventEncrypter" AND message="Published records to Kinesis stream"
|timechart count by message

Is this wrong?

Re: Display time graph based on peak events over time || based on the log occurence i need to plot the graph over time

d942725 — Tue, 18 Feb 2020 10:23:19 GMT

Yeah able to do and it works as expected.

Re: Display time graph based on peak events over time || based on the log occurence i need to plot the graph over time

to4kawa — Tue, 18 Feb 2020 21:00:02 GMT

please acceptand close your issue.

Re: Display time graph based on peak events over time || based on the log occurence i need to plot the graph over time

Richfez — Wed, 19 Feb 2020 20:17:47 GMT

I moved your comment to an answer, and it seems pretty apparent the user accepts this, so I will accept for him.