topic Re: plot time against date in graph in Splunk Search

plot time against date in graph

usha_nittala — Mon, 04 Aug 2014 06:56:17 GMT

Hi everyone,

Is it possible to plot time which is in HH:MM format agains date which is in MM/DD/YYYY format .
the hours should come on y-axis and date on x-axis.

here is my sample data:

JOB NAME,ENDTIME,FORM,     DATE
FCIND60 ,23:45,EXCHANGES  ,22:58,03/27/2014
FMEGD70 ,23:45,EXCHANGES  ,23:39,03/27/2014
FSLCD70 ,23:45,EXCHANGES  ,22:49,03/28/2014
FRSCD80 ,23:45,EXCHANGES  ,22:45,03/27/2014
FKEND70 ,23:45,EXCHANGES  ,23:00,03/29/2014

Re: plot time against date in graph

martin_mueller — Mon, 04 Aug 2014 07:05:48 GMT

Sure. Assuming your time field is TIME and your date field is DATE, you can do this:

base search | eval _time = strptime(DATE, "%m/%d/%Y") | eval seconds = TIME.":00" | convert dur2sec(seconds) | timechart span=1d avg(seconds)

Re: plot time against date in graph

usha_nittala — Wed, 06 Aug 2014 04:35:31 GMT

Thanks so much Martin, but the problem I have is the file is not indexed and hence I cannot use timechart, I am using chart instead.

Re: plot time against date in graph

martin_mueller — Wed, 06 Aug 2014 18:48:49 GMT

You can use timechart once you've set the _time field.