topic Re: Make a graph in Splunk Search

Make a graph

hxa27 — Mon, 28 Sep 2020 15:56:51 GMT

Hi, I am using this query

sourcetype=TraceDropOff| transaction startswith="Starting Main" endswith="DropOff application execution complete" |eval "Event End Time"=strftime(_time+duration, "%m-%d-%Y %H:%M:%S")|eval "Event Start Time"=strftime(_time, "%m-%d-%Y %H:%M:%S")| rename source as "Log Location" | eval Duration(Seconds)=strftime(duration,"%M:%S") | table "Log Location","Event Start Time","Event End Time", Duration(Seconds)

and I am trying to graph the Duration(second) column with the Log Location but since these are not fields am not able to graph my data. Any suggestion??

Thanks

Re: Make a graph

martin_mueller — Thu, 20 Feb 2014 21:54:34 GMT

How 'bout this?

sourcetype=TraceDropOff | transaction startswith="Starting Main" endswith="DropOff application execution complete" | timechart avg(duration) by source

Re: Make a graph

hxa27 — Thu, 20 Feb 2014 22:04:42 GMT

Thanks for the response

Probably you misunderstood my question.I am trying to graph the result of each duration but the query you wrote is giving the avg duration.

Thanks again

Re: Make a graph

martin_mueller — Thu, 20 Feb 2014 22:07:30 GMT

What should the graph look like instead?

Re: Make a graph

hxa27 — Thu, 20 Feb 2014 22:30:12 GMT

we are trying to see how long it takes to receive the response. Then we can set up an alert whenever the process exceeds our max.The graph will be easier for us to read and compare .

Re: Make a graph

martin_mueller — Thu, 20 Feb 2014 22:46:40 GMT

Sooo... You're looking for max(duration) instead of avg(duration)?

Re: Make a graph

hxa27 — Thu, 20 Feb 2014 22:56:17 GMT

Yes, and showing the time it takes as Y axis in minute ans second

Re: Make a graph

martin_mueller — Thu, 20 Feb 2014 22:59:47 GMT

Showing the time in MM:SS on the Y axis isn't going to be easy, if at all possible with the built-in charting. Just go with either seconds or minutes, the viewer is going to understand it.

Re: Make a graph

hxa27 — Thu, 20 Feb 2014 23:01:25 GMT

ok, and how can I do the minutes ?

Re: Make a graph

martin_mueller — Thu, 20 Feb 2014 23:05:12 GMT

Add this after the timechart:

... | eval duration = duration / 60 | rename duration as "Duration in minutes"