topic Re: Linegraph with Datestring / Convert Timestamp to _time in Splunk Search

Linegraph with Datestring / Convert Timestamp to _time

HeinzWaescher — Tue, 05 Nov 2013 17:43:41 GMT

Hi,

I've got a lookupfile with a timestamp (in seconds) and other entries. I've converted the timestamp into a datestring to make it readable (eval Date=strftime(timestamp), "%d.%m.%Y" ) and used a | stats ... by Date command. In a table thats fine, all stats are grouped by the Date.

But when I want to create a Visualization the entries on the X-Axis (the Dates) are not readable. Is there a way to avoid this? Or perhaps it's useful/possible to convert the timestamp to "_time" here and create everything as a timechart?

Thanks in advance for your ideas.

Heinz

Re: Linegraph with Datestring / Convert Timestamp to _time

somesoni2 — Tue, 05 Nov 2013 17:54:21 GMT

Could you post some sample data from the table your got after your stats command?

Re: Linegraph with Datestring / Convert Timestamp to _time

HeinzWaescher — Tue, 05 Nov 2013 18:01:58 GMT

Hi somesoni2,

the table looks like this in the end (unfortunately i don't know how to add a table here...)

Date | A | B | C

27.10.2013 | 100 | 67 | 67

Re: Linegraph with Datestring / Convert Timestamp to _time

HeinzWaescher — Wed, 06 Nov 2013 13:38:21 GMT

I just tried something out: I used the example above, but used a Unixtimestamp as Date and tried to use this timestamp in a timechart.

In my opinion it seems to work. If somebody knows that this kind of transformation causes problems I haven't found out yet, please let me know 😉