topic Re: making a chart in Splunk Search

making a chart

harsh1734 — Mon, 28 Sep 2020 14:31:22 GMT

hi,
by running this query in search field
index="New" "Phase * ended" | table phaseinformation , phase_ended , datetime | rename datetime as DATE , phaseinformation as Phase_Info , phase_ended as Phase_End_Time | sort Phase_End_Time by desc

i got the following output

Phase_info Phase_End_Time DATE

phase 1 ended 1200 secs jul 16 12:04:44
phase 0 ended 1000 secs jul 16 11:02:48

now i can make chart of this by simply clicking on reports..but i am not able to get clear representation of phase_info on x axis and phase_end_time on y axis....
so need to make a clear graph..

Re: making a chart

kml_uvce — Wed, 07 Aug 2013 11:01:09 GMT

can you explain more...

Re: making a chart

linu1988 — Wed, 07 Aug 2013 11:13:03 GMT

You can't do a chart to show that the event came at that time. Some numerical value is needed to plot a graph , e.g. time per phase_info. Thanks

Re: making a chart

zeroactive — Mon, 28 Sep 2020 14:45:55 GMT

Without a larger data set to look at, and without more details about what you want, it's hard to provide direction. You could do a chart that provides the SUM or AVG (average) Phase_End_Time for each Phase_Info value, but just plotting the End Time values for the Phase_Info values isn't going to provide you any value over a table of the results.