topic Re: How to plot Time (in hours) in Y-axis and Date in X-axis? in Splunk Search

How to plot Time (in hours) in Y-axis and Date in X-axis?

smhsplunk — Wed, 12 Oct 2016 13:37:24 GMT

So I am trying to plot Hours in Y axis and the Time in the X-axis (the time is the first time events related to a particular host appeared).
Please note I am accumulating time of each source (first and last event) and adding them to make total time of host (yes, I want to find exact time).

So far I have this, it gives me barplot with time (not so sure about the last line)

index=main host="*"
                | stats earliest(_time) as First latest(_time) as Last by source, host
                | eval difference=Last-First 
                | stats sum(difference) as total_difference by host
        | eval total_difference = total_difference/3600
                | chart max(total_difference) by host, First

I don't have date on my X-axis
I would like each host to have a different color and would like to order the hosts by date

Re: How to plot Time (in hours) in Y-axis and Date in X-axis?

hunters_splunk — Wed, 12 Oct 2016 14:41:25 GMT

Hi smhsplunk,

I think the last line in your query should be:

...
| chart max(total_difference) over First by host

Please see if it works. Thanks!
Hunter Shen

Re: How to plot Time (in hours) in Y-axis and Date in X-axis?

smhsplunk — Wed, 12 Oct 2016 15:10:05 GMT

Perhaps this is working

index=main host="*"
                | stats earliest(_time) as First latest(_time) as Last by source, host | eval Date = strftime(First, "%Y-%m-%d")
               | eval difference= Last-First | eval difference=difference/3600 | chart eval(sum(difference)) as total_difference over Date by host

Re: How to plot Time (in hours) in Y-axis and Date in X-axis?

somesoni2 — Wed, 12 Oct 2016 15:59:08 GMT

This should do it.

index=main host="*"
                 | stats earliest(_time) as _time latest(_time) as Last by source, host
                 | eval difference=Last-_time 
                 | stats min(_time) as _time sum(difference) as total_difference by host
         | eval total_difference = total_difference/3600
             | table _time host total_difference

Try this as well

index=main host="*"
                 | stats earliest(_time) as _time latest(_time) as Last by source, host
                 | eval difference=Last-_time 
                 | stats min(_time) as _time sum(difference) as total_difference by host
         | eval total_difference = total_difference/3600
             | table _time host total_difference | xyseries _time host total_difference