topic Re: plotting date versus time chart in Splunk Search

plotting date versus time chart

usha_nittala — Mon, 12 May 2014 10:41:08 GMT

Hi ,
I have a requirement to present a report to show three jobs and what time they start every day.

Eg:

                abc           xyz           lmn
05/10/14        21:30         21:30         21:40
05/11/14        21:35         21:45         21:40
05/12/14        21:30         22:00         21:50

All these three jobs run everyday so I want to plot time when they started as the time might differ for each job everyday.

Re: plotting date versus time chart

somesoni2 — Mon, 28 Sep 2020 16:34:53 GMT

If you have fields like _time (job run date time) and job_name, then try this:

you base search giving _time, job_name | eval Date=strftime(_time,"%d/%m/%y") | eval Time=strftime(_time,"%H:%M") | chart first(Time) over Date by job_name

Re: plotting date versus time chart

usha_nittala — Mon, 28 Sep 2020 16:36:25 GMT

Thanks for the answer.

I have already tried something like this:

| inputcsv mytest.csv | search JOB_NAME="jobstart1" | eval actual=round(strptime(ACT_TIME,"%H.%M"),0) | chart last(actual) over JOB_DATE by JOB_NAME

Its giving me output in this format:

JOB_DATE jobstart1

03/18/2014 1400031300

03/19/2014 1400031900

03/20/2014 1400031600

This giving me time in wierd format.1400031300

How to convert this time to readable format i.e 1400031300 should be 21:35

Thanks,
Usha

Re: plotting date versus time chart

harshavrath — Mon, 28 Sep 2020 16:36:28 GMT

Hi,

The output is in EPOCh(Unix)Time you can convert it by using |fieldformat NEW_Field=strftime(date/Time_field."%d-%m-%Y %H: %M: %S")

Re: plotting date versus time chart

usha_nittala — Mon, 28 Sep 2020 16:36:35 GMT

I tried this way and got the chart:
| inputcsv mytest.csv| search JOB_NAME="jobstart1" | eval actual=strftime(strptime(ACT_TIME,"%H.%M"),"%H:%M") | chart first(actual) over JOB_DATE by JOB_NAME
and got output like this:
JOB_DATE jobstart1

03/18/2014 21:35

03/19/2014 21:30

03/20/2014 21:45

when I am trying to see the visualization in splunk using line chart.Its not showing anything.. It should show three seperate line as date is on x -axis and time is on y-axis.

Where am I going wrong?

Re: plotting date versus time chart

somesoni2 — Wed, 14 May 2014 15:31:09 GMT

For visualization you need numeric data for y axis, here the time is string.