topic Re: Visualization from different fields in Training + Certification Discussions

Visualization from different fields

kiran007 — Fri, 07 May 2021 18:46:37 GMT

Hi,

I wanted to create a Visualization from 3 different fields shown below.

the values are above 100. so, I am unable to get any trend on graph. Kindly help me out from this.

Thanks & Regards,

S.Kiran.

Re: Visualization from different fields

s2_splunk — Fri, 07 May 2021 20:20:01 GMT

I am not sure what visualization you are expecting, but you are missing an X-Axis value (like _time) in your result set for a graph to work. Try

... | table _time AC_IN_time, ....

and it should plot your three values over time and auto-adjust the Y-axis scale to match your values.

Re: Visualization from different fields

ITWhisperer — Fri, 07 May 2021 22:34:27 GMT

Your extraction is replacing ms with spaces which means it will continue to be treated as a string rather than a number. Also, if you extract to the field name you want, you don't have to then rename the field.

| rex field=data.msg "cancelAppointment.\s(?P<CA_Time>\d*)" | rex field=data.msg "bookAppointment.\s(?P<BA_Time>\d*)" | rex field=data.msg "appointmentCheckIn.\s(?P<AC_In_Time>\d*)"