topic Re: Timechart /chart in Splunk Search

Timechart /chart

swetasoneji — Fri, 27 Apr 2018 14:05:29 GMT

I'm looking to have line chart, which shows AccountID , Username and duration, how would put this with timechart chart so I can have all 3 columns in line chart which says loading time duration on AccountID. or should try using Pivot

Re: Timechart /chart

FrankVl — Fri, 27 Apr 2018 14:13:58 GMT

Not 100% sure what you are looking for, perhaps you can share a sample / screenshot of the data you have and explain a bit more how you want to visualize it?

If you want to plot the duration over time for each account, you could try something like this:

| timechart avg(duration) by AccountID

If you want both the AccountID and the Username in the series label, then you would have to glue those together into a new field first and then use that field in the by clause:

| eval UsernameID = Username." - ".AccountID
| timechart avg(duration) by UsernameID

Re: Timechart /chart

swetasoneji — Fri, 27 Apr 2018 14:38:29 GMT

Thanks, above can be useful later however I'm trying to achieve, how long each account is taking to load. so avg(duration) won't be ideal.
So Line chart/column chart should show AccountID, Username and Duration.

Re: Timechart /chart

swetasoneji — Fri, 27 Apr 2018 14:41:26 GMT

As above showing avg of duration. I'm looking for how much duration each AccountID taking to launch with their Username. It should show actual duration instead avg.

Re: Timechart /chart

FrankVl — Fri, 27 Apr 2018 14:43:57 GMT

As I mentioned, I didn't completely understand what you are looking for, so just took a stab at it 🙂

I still don't really follow what you want to achieve to be honest. As mentioned: can you share perhaps what the data looks like before you visualize it? And elaborate a bit on what you want the visualization to show (e.g. what should be on X axis, what on Y axis, what should be the series)?

Re: Timechart /chart

swetasoneji — Fri, 27 Apr 2018 14:48:06 GMT

Thanks for above, Basically I would like to Put duration on X Axis and Y- AccountID/USername

Re: Timechart /chart

FrankVl — Fri, 27 Apr 2018 14:55:18 GMT

Ok, so no timechart then.

| chart avg(Duration) over AccountID

And then select a horizontal bar chart, to make the duration show on the x-axis.

You need to apply some stats function to the field you are visualizing, you cannot simply put | chart Duration over AccountID. If there is only 1 Duration per AccountID in your data, then avg() will return that Duration, so that should be fine. If there are multiple Durations in your data, then you need to think what would be the best stats function for you to use (min(), max(), latest()...).

Re: Timechart /chart

swetasoneji — Fri, 27 Apr 2018 15:31:27 GMT

Can I put _time as third field?
| eval UsernameID = Username." - ".AccountID

Or perhaps, Duration, Time on X axis and Y axis AccountID/USername

Re: Timechart /chart

FrankVl — Fri, 27 Apr 2018 16:16:10 GMT

Sure you can concatenate a time string to that combined field as well. You might have some challenges sorting it in a meaningful way, but just give it a try.

Not sure how you envision putting duration combined with time on the x-axis. I would say you want to keep the duration on its own, otherwise you can't visualize it anymore as numeric values.

But again: I'm a bit lost as to what you actually want to achieve in the end.