topic Re: How to plot a timechart for calculated value? in Splunk Search

How to plot a timechart for calculated value?

anooshac — Tue, 20 Sep 2022 08:39:52 GMT

Hi all,

I am calculating a value from data and i want to plot it in a timechart.

I tried to plot timechart like this but it is not working and it is giving no results found. Is there anything needs to be done to plot a calculated value in a timechart?

Re: How to plot a timechart for calculated value?

bowesmana — Tue, 20 Sep 2022 07:34:44 GMT

You need to have a _time field in the data to be able to do timechart. If you set _time=stime, then you will at least get some data.

Also, you cannot do the MTTR rounding the way you are doing it, as there is no field as MTTR in a timechart when you split by a field. The columns will be named as the variants of JENKINS_URL

In order to round these, you need to have this logic to round unknown field names after the timechart

| foreach * [ eval "<<FIELD>>"=round('<<FIELD>>', 2) ]

Re: How to plot a timechart for calculated value?

anooshac — Tue, 20 Sep 2022 08:53:06 GMT

@bowesmanaThank you so much for the information. I will try to use that.

Is there any method so that i can get monthly wise data apart from timechart?

Re: How to plot a timechart for calculated value?

bowesmana — Tue, 20 Sep 2022 22:51:14 GMT

Short answer - YES !

There are many ways to do almost anything in Splunk, but when dealing with time, there are typically 3 ways to do stats on time

timechart, stats and chart.

Naturally timechart is a simple way to produce time based information, but you can also use

| bin _time span=1mon | stats count by _time

which will produce the same output as

| timechart span=1mon count

with a column called _time and a column called count

However, if you do

index=audit | bin _time span=1h | stats count by _time user

and

index=audit | timechart span=1h count by user

You will see a very different row/column output.

timechart will have a column per user all on the same _time row, whereas stats will have 3 columns, _time, user and count, with a repeated time row per user.

So, really to answer your question, you should know what output information you want to achieve and then find the correct SPL to achieve that output.

Re: How to plot a timechart for calculated value?

anooshac — Thu, 22 Sep 2022 09:02:57 GMT

hi @bowesmana ,Thank you so much,

I tried,

| bin _time span=1mon | stats count by _time user

I am able to create a chart, but the span is not considered as 1 month, instead it is taking random spans and giving values. Is there any different way to specify span?

Re: How to plot a timechart for calculated value?

bowesmana — Sat, 24 Sep 2022 03:04:16 GMT

I'm not sure how you can be getting random spans, as that bin command will bin by a 1 month span and in your statistics tab you will have the _time column showing YYYY-MM (year/month)

Can you post your search and output

Re: How to plot a timechart for calculated value?

anooshac — Tue, 27 Sep 2022 04:20:20 GMT

Hi @bowesmana I got the time field like this.

Re: How to plot a timechart for calculated value?

bowesmana — Tue, 27 Sep 2022 07:57:37 GMT

There is nothing wrong with that set of dates, I assume there is a user against each row.

Is there a reason why you don't use timechart?

When you use bin+stats then it will not give months where there is no data for a user - it would be better to use timechart.

You can use 'makecontinous' command to fill in the 'gaps' but using timechart is the right solution