topic Re: Timechart and overlay two columns? in Splunk Search

Timechart and overlay two columns?

snipedown21 — Fri, 13 Oct 2017 06:32:28 GMT

I have a field outcomeIndicator in my data, that holds values 0,1,5,8.
0 and 1 mean a success of the event, and 5 and 8 mean failure.
Now, I want to use timechart count to plot these values over a month, for a span of 1 day, i.e the timechart must show the total events in a day resulting in success and failures, for the previous 30 days.
This timechart must strictly be graphical and must show the trend for both failures and successes over a month.

Here the green colored trend-line represents the success per day for a month and the red colored trend-line represents failures per day over a month. The image is just for representation and I want to know the possibilities of achieving this.
Thank you.
Cheers.
-Snipedown21

Re: Timechart and overlay two columns?

gcusello — Fri, 13 Oct 2017 06:50:06 GMT

Hi snipedown21,
try something like this:

your_search
| eval result=if(outcomeIndicator<2,"Success","Failure")
| timechart count by result

To set the green and red colors use

<option name="charting.legend.labels">[Success,Failure]</option>
<option name="charting.seriesColors">[0x008000,0xFF0000]</option>

Bye.
Giuseppe

Re: Timechart and overlay two columns?

snipedown21 — Fri, 13 Oct 2017 08:52:48 GMT

Hi Giuseppe.
Dude!!! That was absolutely perfect. Even the color schemes I had put up in the sample were exactly what you gave me.
Thank you a lot.