topic Re: Need help in creating timechart query in Splunk Search

Need help in creating timechart query

jcvytla — Wed, 04 Apr 2018 22:34:58 GMT

I have hourly data for 30 days on execution of jobs. I wanted to create a timechart based on elapsed time. could you please help me through. my query:

| inputlookup xxxx.csv |eval in_epoch = strptime(time, "%m/%d/%Y %H:%M") | timechart span=1d as ElapsedTime

Could you please help?

Re: Need help in creating timechart query

adonio — Thu, 05 Apr 2018 01:33:10 GMT

try this:
| inputlookup xxxx.csv |eval _time = strptime(time, "%m/%d/%Y %H:%M") | timechart span=1d as ElapsedTime

Re: Need help in creating timechart query

splunker12er — Thu, 05 Apr 2018 04:26:17 GMT

try this,

| inputlookup xxxx.csv |eval in_epoch = strptime(time, "%m/%d/%Y %H:%M")  | bucket in_epoch span=1d| stats count values(your_field) as your_field by in_epoch |convert ctime(in_epoch)

Re: Need help in creating timechart query

splunker12er — Thu, 05 Apr 2018 04:28:11 GMT

try this,

 | inputlookup xxxx.csv |eval in_epoch = strptime(time, "%m/%d/%Y %H:%M")  | bucket in_epoch span=1d| stats count values(your_field) as your_field by in_epoch |convert ctime(in_epoch)

Re: Need help in creating timechart query

mayurr98 — Thu, 05 Apr 2018 07:28:40 GMT

I think you should try something like this

| inputlookup xxxx.csv |eval _time=strptime(time, "%m/%d/%Y %H:%M") | timechart span=1d count

| inputlookup xxxx.csv |eval _time=time | bin _time span=1d | stats count by _time

let me know if this helps!

Re: Need help in creating timechart query

jcvytla — Thu, 05 Apr 2018 17:23:43 GMT

Hi @adonio,

Thanks for your response.I'm getting this error while running the your solution:

"Error in 'timechart' command: The specifier 'as' is invalid. It must be in form (). For example: max(size)."

Re: Need help in creating timechart query

jcvytla — Thu, 05 Apr 2018 17:25:21 GMT

HI Mayur,

Thanks for your response. But, both the solution are not working. Data is not being populated in the first place.

Thanks

Re: Need help in creating timechart query

jcvytla — Thu, 05 Apr 2018 17:27:28 GMT

Hi @splunker12er,

Thanks for your response. I don't get any error, but is not being populated