topic Re: create chart monthly/weekly in Splunk Search

create chart monthly/weekly

kml_uvce — Mon, 28 Sep 2020 11:25:37 GMT

I have a requirement in that i have events for diiffrent dates

28,489,BLR 3BC019-Web18,172.22.16.21, Mani Sundaram,72.246.2.183,00259004993e,20,2012-02-16 10:07:40,00:01:01,In,H.323,None,1600,1600,H.264,G.711Ulaw,1280x720,H.264,G.711Alaw,1280x720,No,No,None,Normal,0.000,0.000,0,1,0.000,12.000,0,19,0.000,0.000,0,1,1.000,29.000,1,30,0.000,0.000,0,0,0.000,0.000,0,0,vtc-3bc019-Web18.bangalore

in this event the date is field end_date '2012-02-16' and duration is field duration '20' sec
so there are many diffrent dates (end_date) for a month, so this will be in many months
I want a search that shows me every month duration (sum of duration for a month and shows for month not for date)
also search for weekly duration.

Re: create chart monthly/weekly

Ayn — Tue, 21 Feb 2012 14:43:57 GMT

What have you tried so far? What is working or not working?

Re: create chart monthly/weekly

kml_uvce — Tue, 21 Feb 2012 15:15:06 GMT

i tried

|chart sum(duration) over end_date

and the output is
end_date sum(duration)
1 2010-06-03 13:35:56 11
2 2010-07-09 10:01:59 3600
3 2010-07-27 16:08:38 3963
4 2010-07-27 17:08:35 280
5 2010-07-28 09:57:09 1550
6 2010-07-28 14:05:03 9006
7 2010-07-28 15:32:01 3375
8 2010-07-28 19:06:40 11171
9 2010-08-02 15:26:14 1581
10 2010-08-03 12:32:41 1963

I want output like this
month sum
june ....
July ...
etc

If output comes in graph/chart then it will be good