https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-chart-based-on-Duration-x-axis-and-timestamp-y/m-p/284621#M86076 <P>thank you so much.... its working</P> Mon, 19 Dec 2016 18:13:06 GMT chanamoluk 2016-12-19T18:13:06Z https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-chart-based-on-Duration-x-axis-and-timestamp-y/m-p/284615#M86070 <P>How to generate a chart based on Duration (x-axis) and timestamp (y-axis)?</P> <P><STRONG>12/19/2016 10:30:53 AM</STRONG><BR /> LogName=JHApplication<BR /> ... 7 lines omitted ...<BR /> RecordNumber=23080258<BR /> Keywords=Classic<BR /> Message=Action=ConsumeMessage, ConsumerType=InprocConsumer, ConsumerTypeName=WorkflowEndpoint, ConsumerMethodName=CustomerUpdateResponse, ConsumerParam=XmlNode, MessageId=1b411832-3625-4c19-aaf6-22a258a4dabd\1844534213, <STRONG>Duration=0.0284597</STRONG></P> Mon, 19 Dec 2016 15:32:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-chart-based-on-Duration-x-axis-and-timestamp-y/m-p/284615#M86070 chanamoluk 2016-12-19T15:32:37Z https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-chart-based-on-Duration-x-axis-and-timestamp-y/m-p/284616#M86071 <P>Try this</P> <PRE><CODE>your base search | stats values(Duration) as Duration by _time </CODE></PRE> Mon, 19 Dec 2016 17:12:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-chart-based-on-Duration-x-axis-and-timestamp-y/m-p/284616#M86071 somesoni2 2016-12-19T17:12:45Z https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-chart-based-on-Duration-x-axis-and-timestamp-y/m-p/284617#M86072 <P>index=* host=*MQ004 Duration|stats values(Duration) as Duration by _time</P> <P>it is showing only the _time but it is not displaying the Duration value, every minute it is generating 10 to 20 messages</P> Mon, 19 Dec 2016 17:32:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-chart-based-on-Duration-x-axis-and-timestamp-y/m-p/284617#M86072 chanamoluk 2016-12-19T17:32:04Z https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-chart-based-on-Duration-x-axis-and-timestamp-y/m-p/284618#M86073 <P>Is Duration field already extracted (can you see the field Duration in the field sidebar)? If not then try something like this</P> Mon, 19 Dec 2016 17:33:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-chart-based-on-Duration-x-axis-and-timestamp-y/m-p/284618#M86073 somesoni2 2016-12-19T17:33:55Z https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-chart-based-on-Duration-x-axis-and-timestamp-y/m-p/284619#M86074 <P>no i can't see Duration field on the left side</P> Mon, 19 Dec 2016 17:35:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-chart-based-on-Duration-x-axis-and-timestamp-y/m-p/284619#M86074 chanamoluk 2016-12-19T17:35:19Z https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-chart-based-on-Duration-x-axis-and-timestamp-y/m-p/284620#M86075 <P>Strange. It's in standard key value pair format and should've been extract. Try something like this</P> <PRE><CODE>index=* host=*MQ004 Duration | rex "Duration=(?&lt;Duration&gt;\d+(\.\d+)*)" |stats values(Duration) as Duration by _time </CODE></PRE> <P>OR</P> <PRE><CODE>index=* host=*MQ004 Duration | rex "Duration=(?&lt;Duration&gt;\d+(\.\d+)*)" |timechart avg(Duration) as Duration </CODE></PRE> Mon, 19 Dec 2016 17:40:24 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-chart-based-on-Duration-x-axis-and-timestamp-y/m-p/284620#M86075 somesoni2 2016-12-19T17:40:24Z https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-chart-based-on-Duration-x-axis-and-timestamp-y/m-p/284621#M86076 <P>thank you so much.... its working</P> Mon, 19 Dec 2016 18:13:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-chart-based-on-Duration-x-axis-and-timestamp-y/m-p/284621#M86076 chanamoluk 2016-12-19T18:13:06Z