https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-inputlookup-search-to-create-a-time-chart-of/m-p/261851#M78617 <P>Try this</P> <PRE><CODE> |inputlookup Mapr_Ticket_Metrics.csv| eval Status= if(Status!="Closed", "Open", "Closed")|eval dtm=strptime("Date/Time Opened", "%m/%d/%Y") | bin span=1mon dtm | chart count over dtm by Status | eval dtm=strftime(dtm, "%m/%d/%Y") | rename dtm AS "Date/Time Opened" </CODE></PRE> Tue, 30 Aug 2016 20:49:28 GMT sundareshr 2016-08-30T20:49:28Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-inputlookup-search-to-create-a-time-chart-of/m-p/261850#M78616 <P>Hi,</P> <P>We are looking for time chart that would give Status over time from our CSV file.</P> <P>Line graph should plot by Month (this field does not exist in our data).</P> <P>Here is sample data from the lookup which has date/Time Opened field. Using this, we need to get a timechart by status over month.</P> <PRE><CODE>Case Contact Name Subject Status Case Age (days) Owner Name Date/Time Opened 29541 Yalamanchil Memory Open 289 Chandhok 11/11/2015 11:23 35594 Mullangi Gold DR- Closed 149 Chandhok 3/30/2016 9:00 37506 Yalamanchili CORAL volume Open 100 Chandhok 5/18/2016 21:16 </CODE></PRE> <P>Sample search looks like below:</P> <PRE><CODE>|inputlookup Mapr_Ticket_Metrics.csv| eval Status= if(Status!="Closed", "Open", "Closed")|chart count over "Date/Time Opened"`by Status </CODE></PRE> <P>This search lists by time value (but we need to aggregate these by month, our X-Axis should give month)</P> <P>Thanks</P> Tue, 30 Aug 2016 20:45:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-inputlookup-search-to-create-a-time-chart-of/m-p/261850#M78616 splunker9999 2016-08-30T20:45:47Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-inputlookup-search-to-create-a-time-chart-of/m-p/261851#M78617 <P>Try this</P> <PRE><CODE> |inputlookup Mapr_Ticket_Metrics.csv| eval Status= if(Status!="Closed", "Open", "Closed")|eval dtm=strptime("Date/Time Opened", "%m/%d/%Y") | bin span=1mon dtm | chart count over dtm by Status | eval dtm=strftime(dtm, "%m/%d/%Y") | rename dtm AS "Date/Time Opened" </CODE></PRE> Tue, 30 Aug 2016 20:49:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-inputlookup-search-to-create-a-time-chart-of/m-p/261851#M78617 sundareshr 2016-08-30T20:49:28Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-inputlookup-search-to-create-a-time-chart-of/m-p/261852#M78618 <P>Give this a try</P> <PRE><CODE> |inputlookup Mapr_Ticket_Metrics.csv| eval Status= if(Status!="Closed", "Open", "Closed") | eval _time=strptime('Date/Time Opened',"%m/%d/%Y %H:%M") | timechart span=1mon count by Status </CODE></PRE> Tue, 30 Aug 2016 21:49:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-inputlookup-search-to-create-a-time-chart-of/m-p/261852#M78618 somesoni2 2016-08-30T21:49:44Z