topic Re: How do I make a line graph with my timechart search? in Splunk Search

How do I make a line graph with my timechart search?

alanxu — Thu, 27 Aug 2015 19:53:55 GMT

This is a table I created using the timechart command. Now, I am trying to make a line graph with this information with date on the x-axis and completion time for the y-axis. If I am able to solve that, I would love to add extra lines to the line graph.

<searchString>host=... source = ... Position="Finished" AND Report  | timechart latest(TIME) as Completion_Time</searchString>
<earliestTime>-168h</earliestTime>
<latestTime>$timetoken.latest$</latestTime>

This is inside my dashboard atm. I have a drop down for time at the top.

Re: How do I make a line graph with my timechart search?

somesoni2 — Tue, 29 Sep 2020 07:08:20 GMT

The Completion_Time field is string value and as far as I know, strings can't be plotted in Y-axis (you need numerical values). Workaround, you can convert your Completion_Time to decimal number like HH.MM and plot them.

Re: How do I make a line graph with my timechart search?

alanxu — Thu, 27 Aug 2015 20:57:33 GMT

OH! I see.. What was the command again? str..() lol.

Re: How do I make a line graph with my timechart search?

tskinnerivsec — Tue, 29 Sep 2020 07:08:18 GMT

you should be using timechart on _time field

timechart latest(_time) as "Completion_Time" | convert ctime("Completion_Time") | . . .

the convert ctime converts _time to a human readable format for you.

Re: How do I make a line graph with my timechart search?

somesoni2 — Thu, 27 Aug 2015 21:06:20 GMT

| eval Completion_Time=tonumber(replace(Completion_Time,"(\d+):(\d+):(\d+)","\1.\2"))

Re: How do I make a line graph with my timechart search?

alanxu — Thu, 27 Aug 2015 21:07:09 GMT

Ill try that out right now. Would you know how to do the line graph?

Re: How do I make a line graph with my timechart search?

alanxu — Thu, 27 Aug 2015 21:07:37 GMT

Oh and the _time field wont work well because I extracted TIME from the log file.

Re: How do I make a line graph with my timechart search?

alanxu — Thu, 27 Aug 2015 21:10:43 GMT

Whats the 1 and 2 for?

Re: How do I make a line graph with my timechart search?

alanxu — Thu, 27 Aug 2015 21:41:22 GMT

Thank you somesoni2! I got the graph!

Re: How do I make a line graph with my timechart search?

somesoni2 — Thu, 27 Aug 2015 21:51:35 GMT

In replace, I'm clubbing your data in 3 parts (values inside the brackets), and replacing 3 parts named 1,2,3 from current format of 1:2:3 to 1.2

Re: How do I make a line graph with my timechart search?

alanxu — Thu, 27 Aug 2015 21:58:44 GMT

Would you know how to add a second line?

Re: How do I make a line graph with my timechart search?

sideview — Thu, 27 Aug 2015 22:00:39 GMT

What you'd be better off using here is the convert command. Convert has a dur2sec function that is specifically designed for turning strings like "02:34:59" into an integer number of seconds.

host=... source = ... Position="Finished" AND Report | convert dur2sec(TIME) | timechart max(TIME)

http://docs.splunk.com/Documentation/Splunk/6.2.5/SearchReference/Convert

to format it as a line chart you need to edit the visualization. Here it looks like you're in a dashboard panel so make sure you're logged in as an admin, or as someone with edit rights to the dashboard, and click "Edit > Edit Panels". When the panels reload with little edit icons in their top right, the middle icon is the Visualization one, and in that menu there's a "Line" option.

Otherwise if/when you're in the generic Search UI you would look under the "visualization" tab. In both cases setting the visualization to Line chart is pretty straightforward.

Re: How do I make a line graph with my timechart search?

alanxu — Thu, 27 Aug 2015 22:03:06 GMT

Would you know how to add a second line?

host=.. source =.. SOMESTRINGTOLOOKFOR   | timechart latest(TIME) as Completion_Time | eval Completion_Time=tonumber(replace(Completion_Time,"(\d+):(\d+):(\d+)","\1.\2"))

Re: How do I make a line graph with my timechart search?

alanxu — Thu, 27 Aug 2015 22:05:10 GMT

Im not sure if I would want it in seconds. But ill see if there are other commands

Re: How do I make a line graph with my timechart search?

somesoni2 — Thu, 27 Aug 2015 22:11:49 GMT

What you want to show in the second line?

Re: How do I make a line graph with my timechart search?

alanxu — Thu, 27 Aug 2015 22:16:02 GMT

 host=.. source =.. SOMESTRINGTOLOOKFOR   | timechart latest(TIME) as Completion_Time | eval Completion_Time=tonumber(replace(Completion_Time,"(\d+):(\d+):(\d+)","\1.\2"))

Re: How do I make a line graph with my timechart search?

alanxu — Thu, 27 Aug 2015 22:16:33 GMT

That is what I have right now... So I want to add a second line which also has SOMESTRINGTOLOOKFOR and get the exact same data.. The completion_Time

Re: How do I make a line graph with my timechart search?

somesoni2 — Thu, 27 Aug 2015 22:20:02 GMT

So your just want another line with same name as SOMESTRINGTOLOOKFOR and have same values as Completion_Time?

Re: How do I make a line graph with my timechart search?

alanxu — Thu, 27 Aug 2015 22:21:27 GMT

It will be a different string i would be looking for.. but yeah looking for completion time too.. When I was looking online they use a comma in time chart but im not sure how I could make it work

Re: How do I make a line graph with my timechart search?

alanxu — Thu, 27 Aug 2015 22:30:30 GMT

So I would want the exact same thing but the SOMESTRINGTOLOOKFOR has an unique completion time. So it would be nice to have both.