Hi..
My search query returns me a set of 150 records and when i try to plot a graph for these 150 records , I hardly see the values for 40 records remaning were not actually plotted or shown in graph..how can i make this enable so that to see all the values coming in the graph....
Thanks in advance.
Ok first up you need to convert Day into a date that splunk'll understand.
| inputlookup StatsData.csv | eval _time=strptime(Day,"%d-%B-%y")
Next up, you want to plot it.
So we can add
| timechart span=1d avg(AvgBest95) as AvgBest95 avg(AvgWorst5) as AvgWorst5
You can then drill into the timeranges.
Even though we're using avg(AvgBest95) - because you have 1 pont a day (or i'm assuming you do) the average will be the same as the single value for the day anyway.
This works on splunk 4.3.x
I've you're running a previous version, you may have to resort to the xyseries method outlined here
another tip - if your dates on the x-axis look messed up even after converting to a format splunk can process adding this, fixes it a lot of the time
| makecontinuous _time
Ok first up you need to convert Day into a date that splunk'll understand.
| inputlookup StatsData.csv | eval _time=strptime(Day,"%d-%B-%y")
Next up, you want to plot it.
So we can add
| timechart span=1d avg(AvgBest95) as AvgBest95 avg(AvgWorst5) as AvgWorst5
You can then drill into the timeranges.
Even though we're using avg(AvgBest95) - because you have 1 pont a day (or i'm assuming you do) the average will be the same as the single value for the day anyway.
This works on splunk 4.3.x
I've you're running a previous version, you may have to resort to the xyseries method outlined here
another tip - if your dates on the x-axis look messed up even after converting to a format splunk can process adding this, fixes it a lot of the time
| makecontinuous _time
Even now i cant see the dates...i have used like this
| inputlookup StatsData.csv | eval _time=strptime(Day,"%d-%B-%y") | fields _time,AvgBest95,Mean95,UCL95,LCL95 | makecontinous _time
Nothing Was getting displayed on X-axis .Can we have any other option for this.i am using splunk 4.3.x only...
and the Day field on X-Axis ..is displaying as "..." instead of "1-JULY-12" , even that was awkard to see ..can we have a better look for this Day..ie vertically on Y-AXIS..is tat possible ? and how can we the get the graph fot all the data ??
Actually i have stored my search results in a csv file..and
these results like this in order..
Day,AvgBest95,AvgWorst5
1-JULY-12 3.00 5.00
....
....
ie. last 3 months data..
i have used the query to retrieve these values like this..
|inputlookup StatsData.csv | fields Day,AvgBest95,AvgWorst5
i have created the line chart graph taking Day on X-Axis and AvgBest95 ,AvgWorst5 on Y-Axis..
The Graph was fine..but it was jus showing me for 1 and a half month data only..but in search results i can see all the 3 months data..i dnt knw wats happening ?
Hi Rakesh - we will need more information in order to help. Can you show us a sample of a couple of the 150 records (sanitized of course) - and your search query?