Dashboards & Visualizations

Help in time filter and sorting

jerinvarghese
Communicator

Hi All,

Need a best solution in plotting a graph. for daily based alerting/ticketing am receiving.

Query am using is below. Also the search is for last 30 days.

 

index=itsm 
| eval Time=strftime(_time,"%b-%d")
| sort - Time
| stats  count by USER Time 
| xyseries  Time USER count 
| fillnull value=0

 

Output, I am getting is:

Time USER
1-Jun 132
2-Jun 260
3-Jun 153
4-Jun 72
5-Jun 147
6-Jun 228
7-Jun 122
8-Jun 195
9-Jun 210
10-Jun 114
11-Jun 148
12-Jun 168
13-Jun 119
14-Jun 299
15-Jun 58
16-May 159
17-May 215
18-May 195
19-May 305
20-May 220
21-May 219
22-May 160
23-May 198
24-May 73
25-May 126
26-May 308
27-May 271
28-May 109
29-May 124
30-May 144
31-May 103

My graph looks like:

line graph.JPG

I am unable to sort it in monthly order, I tried a different way- but I am not getting June after May.

Any other graph way this looks better also pls suggest.

Please help me with this.

Labels (1)
0 Karma

to4kawa
Ultra Champion
index=itsm 
| timechart span=1d by USER
| rename _time as Time
| eval Time=strftime(Time,"%b-%d")

how about this?

 

sample:

| tstats count where index=_audit by _time span=1d
| eval time=strftime(_time,"%b-%d")
| table time count
| head 30

direkp
Engager

You can use timechart

1) count all requests

index=itsm
| timechart span=1d count

 

2) if you want to unique count user

index=itsm
| timechart span=1d dc(user) as user

 

Tags (1)
0 Karma

rnowitzki
Builder

Hi  @jerinvarghese ,


Add this at the very end and it should sort correct.  

 

| eval sort_time=strptime(Time,"%b-%d")
| sort 0 sort_time
| fields - sort_time

 

edit: you should remove your first sort, based on "Time". 

 

--
Karma and/or Solution tagging appreciated.
0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...