topic Dynamically changing the x-axis values in Splunk Search

Dynamically changing the x-axis values

ngerosa — Mon, 28 Aug 2017 13:42:35 GMT

Hi all,
I have this search:

 index="attenuation"
|dedup CONCATENATE_Z
|eval TRATTA=NODO_A."->".NODO_Z 
|lookup eol.csv TRATTA OUTPUT eol as EOL
|search TRATTA="ROMA->MILANO"
|eval DATA=strftime(strptime('END_OF_INTERVAL',"%Y-%m-%d"),"%Y-%m-%d")
|table DATA SPAN_LOSS EOL
| sort DATA

For every "TRATTA" I have many "SPAN_LOSS" values (one per day).
Plotting the chart I can't visualize the values of x-axis maybe because are too many.

How Can I visualize the values of DATA for example grouped by week or month?

Thanks!

Re: Dynamically changing the x-axis values

DalJeanis — Mon, 28 Aug 2017 14:51:11 GMT

From the information that you have provided, we cannot tell what form SPAN_LOSS might take. Below, I'm assuming that it is some kind of number, and that for any particular unit of time you want the sum of that number for the period.

I'm assuming the part of your search limiting your results to the segment from Rome to Milan ("ROMA->MILANO") is not part of your overall requirements, or you'd be doing it in the original search at the top. I've moved it up, but you can pull it out completely after you do some testing.

Try this...

  index="attenuation" NODO_A="Roma" NODO_Z="Milano"
 | fields CONCATENATE_Z NODO_A NODO_Z END_OF_INTERVAL SPAN_LOSS
 | dedup CONCATENATE_Z
 | eval TRATTA=NODO_A."->".NODO_Z 
 | lookup eol.csv TRATTA OUTPUT eol as EOL
 | eval _time=strptime('END_OF_INTERVAL',"%Y-%m-%d")
 | table _time SPAN_LOSS EOL
 | timechart sum(SPAN_LOSS) by EOL

... and then you can try chunking it up to the week span=1w or month span=1mon levels.

 | timechart span=1w sum(SPAN_LOSS) by EOL

Re: Dynamically changing the x-axis values

ngerosa — Tue, 29 Sep 2020 15:31:08 GMT

Hi DalJeanis,
I didn't use timechart because I don't want to do any statistical operation, I want to display, for every "TRATTA", all values of "SPAN_LOSS" and "EOL".
The chart has to display the trend of "SPAN_LOSS" compared to "EOL" over time