topic Re: timechart question in Splunk Search

timechart question

xipander — Thu, 01 Sep 2011 21:12:35 GMT

I'm trying to graph a custom long that gives the round trip time of a web service request. I've got sourcetype="wsping.log" |stats first(RoundTrip) by _time gives me the table with the correct values, but when I try to chart it doesn't show up. I think the problem is that my roundtrip value looks like RoundTrip=00:00:00:12 so it's not showing up in the chart? it logs every second so essentially i need every second/log entry on the x axis and the roundtrip value on the y axis in a line graph so we can see spikes. thanks.

Re: timechart question

RicoSuave — Fri, 02 Sep 2011 01:31:47 GMT

Are you extracting a field for the actual webservice? I would graph the roundtrip time by webservice over time. Try:

<yoursearch> | timechart avg(RoundTrip) by <yourWebServiceField>

Re: timechart question

xipander — Fri, 02 Sep 2011 12:58:09 GMT

Date 09/02/2011 Begin = 08:55:09:13, End = 08:55:09:26, RoundTrip = 00:00:00:12

That's all I have in the log entries, the tables and search results show up right, just the line charts don't. I think it has to do with the way the "times" are formatted it's not graphing them properly?

Re: timechart question

RicoSuave — Fri, 02 Sep 2011 13:23:33 GMT

Try this:
| eval roundtriptime=strptime(RoundTrip,"%S") | chart avg(roundtriptime) over _time

If that doesn't work try strftime instead

Re: timechart question

xipander — Thu, 08 Sep 2011 03:07:23 GMT

This got me going in the right direction. I had to specify the full strptime values.

RoundTrip | eval roundtriptime=strptime(RoundTrip,"%H:%M:%S:%s") | chart avg(roundtriptime) over _time

Re: timechart question

RicoSuave — Thu, 08 Sep 2011 21:26:49 GMT

Sweet. Glad i could help. Can you accept my answer? 🙂