Flow chart

maayan — Sun, 16 Jul 2023 12:51:13 GMT

Hi,

I have a table of 3 columns: Event name, time(=when the event happened) and source (file name).

I need to create a flow chart (similar to the attached picture) when X-axis represents time and Y axis binary (event happen or not).
I need a line for each event name and a different color for each line.
I also need to filter by time range (like the chart in the picture, to have the option to look on different time intervals). Also, click on a specific point and get its raw data (to know from which file it was taken).

Can I do it in Splunk? How?

I tried to create a timeline, but it doesn't look so good :

| eval myTime=TimeStamp/10000000 - 11644473600 | eval WinTimeStamp2=strftime(myTime, "%Y-%m-%dT%H:%M:%S.%Q")
| bin WinTimeStamp2 span=1d | stats count by WinTimeStamp2, Name

example for timestamp=133265876804261336

Thanks,

Maayan

Re: Flow chart

yuanliu — Mon, 17 Jul 2023 07:07:16 GMT

The command you are looking for is timechart, the option to examine data in user-selected time interval is available in dashboard (whether classic aka Simple XML or Dashboard Studio).

Based on sample code you have shown, I suspect that the timechart should look something like

| timechart span=1d count by Name

But you didn't explain the complex acrobat around TimeStamp, so it is hard to say how that is to be transformed into Splunk's native _time.

Your picture suggests that you had some exposure to Grafana. If that is the case, and you want to pick up Splunk, the best course is try to forget the ways of Grafana, which isolates data from visualization and, as a consequence, has no true sense of time. _time is an internal field that is central to Splunk data. In most cases, correct time should be determined at ingestion time so the user (programmer) needn't have to worry about.

topic Re: Flow chart in Splunk Search

Flow chart

Re: Flow chart