Creating a chart by month

[elijahm]

I am trying to make a line graph that shows that months of the year as the x-axis. There should be three lines in this graph. The first line should show the amount of occurrences of the "GetPolicy.doPost(56)" string in each month. The second line should show the amount of occurrences of the string "ActivateNode.doPost(94)" and the third line should show the difference of the occurrences between the two above strings. Below I calculated the difference and I am very new to splunk and I don't know how to move forward with creating the graph.

index= client_snsr_tcg_unix_webservices source="/var/log/tomcat8/catalina.out" "GetPolicy.doPost(56)"

| stats count as start

| appendcols [search index= client_snsr_tcg_unix_webservices source="/var/log/tomcat8/catalina.out" "ActivateNode.doPost(94)"

| stats count as end ]

| eval Difference=start-end

| table Difference

[mayurr98 · Accepted solution]

try this:

index=client_snsr_tcg_unix_webservices source="/var/log/tomcat8/catalina.out" "GetPolicy.doPost(56)" OR "ActivateNode.doPost(94)" 
| stats count(eval(like(_raw,"%GetPolicy.doPost(56)%"))) as "GetPolicy_doPost" count(eval(like(_raw,"%ActivateNode.doPost(94)%"))) as "ActivateNode_doPost" by date_month 
| eval Difference=GetPolicy_doPost-ActivateNode_doPost

And then go to visualization and select appropriate chart to see graph view 🙂

[elijahm]

Thanks so much!