topic Re: chart time based in Splunk Search

chart time based

surekhasplunk — Thu, 29 Sep 2016 07:39:59 GMT

Hi ,

I want a chart exactly like the image attached.

My data is input lookup csv file .
My time filed name is "Opened"
Data Global * field name is "Assignment group"

Please help me with the query.

I tried something like this but this is not what i want.
index=level3 host=Test | chart count over Opened by "Assignment group"

Thanks

Re: chart time based

JDukeSplunk — Thu, 29 Sep 2016 14:22:21 GMT

My first stab at it would be something like this. This will give you 14 days, including yesterday, but not today.

index=level3 host=Test earliest="-14d@d" latest="-0d@d" | timechart span=1d limit=20 count Opened by "Assignment group"

Then in the visualations tab change the format to Column, and Format, stacked.

Re: chart time based

sideview — Thu, 29 Sep 2016 14:43:27 GMT

Are the values in the "Opened" field epochtime values? ie integer numbers of seconds since 1/1/1970, or are they string formatted times. If the latter can you give an example value? Long story short you need to rename the time field to be "_time" and then convert it to epochtime format if it's not already. Then timechart will happily work with it just as though the rows were coming from regular indexed events.

Re: chart time based

surekhasplunk — Fri, 30 Sep 2016 07:19:11 GMT

Now am getting results with the below query but am unable to sort it date wise rather it sorts numerically.
I have two date fields with values like this:

Opened = 09/27
Opened D = 09/29/16

Figure1

index=level3 host=Test | eval _time=strptime("Opened D","%Y-%m-%d %H:%M:%S.%N")|chart count OVER "Opened D" BY "Assignment group" | sort -"Opened D"

Figure2

One more thing in the x-axis instead of “Opened D” how can I get the actual dates ?
If I enable event sampling only then am getting the dates if I slect “No event sampling” then the dates aren’t reflecting. How to solve this ?
And if I am enabling event sampling am missing some dates data also.

Re: chart time based

JDukeSplunk — Fri, 30 Sep 2016 14:04:07 GMT

I think you're going to have to use timechart instead of chart.

http://docs.splunk.com/Documentation/Splunk/6.4.3/SearchReference/Timechart

Maybe..

...|timechart span=1d count(Opened) by "Assignment group"