topic Re: How to create a time chart with row data? in Splunk Search

How to create a time chart with row data?

UMDTERPS — Fri, 05 Feb 2021 22:36:24 GMT

I have search that runs every day that populates a CSV that looks like this (I have more sources, but wanted to keep it more simple to explain):

Source	Total	Server	Workstation	Other	Unknown	date
norton	735	178	542	5	10	1612548722
nessus	857	8	829	9	11	1612548722

I would like a time graph to show each source over time, is this possible? I've tried a few methods, but can't seem to manipulate the data to get it to work right. I know the data will have to be converted using SPL like this |fieldformat date = strftime(date, "%m/%d/%Y").

Any ideas how how to make a time graph by source over time?

Thanks!

Re: How to create a time chart with row data?

richgalloway — Sat, 06 Feb 2021 13:04:49 GMT

I think you already have everything you need. There's no need to convert the date field because it's already in epoch form. You do need to assign date to _time, however. Try this query.

| inputlookup mycsv.csv | eval _time = date | timechart max(Total) as Total by Source

Re: How to create a time chart with row data?

UMDTERPS — Mon, 08 Feb 2021 16:16:44 GMT

Works! Thanks!