Dashboards & Visualizations

How to create a column chart By time Today/Yesterday/LastWeekDay by specific Field value?

sukansingh
Explorer

I want to see the 500 error count for each Customers over time (Today/Yesterday/LastWeekOfDay) So total 3 days.

Below screenshot is Kibana Chart. How can we create same kind of chart in Splunk?

sukansingh_0-1675866432264.png

I have tried below timechart query but x axis have time first instead of customerId.

index="services" statusCode="500" | timechart span=1d count by customerId

I have also tried with below Query But I feel Count in response in not correct.

index="services" statusCode="500" | bucket _time span=day | chart count by customerId,_time | head 10

Is there a better way to do it?

 

 

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

If it is always the last / latest column, you could try something like this

| sort 0
    [| makeresults
    | addinfo 
    | eval search=strftime(info_max_time-1, "%F")
    | fields search
    | format "" "" "" "" "" ""]

View solution in original post

sukansingh
Explorer

Thanks @ITWhisperer , This Query is working for me. Now I'm facing a challenge to sort by specific column let say 3rd column.

index="services" statusCode="500" | bucket _time span=day | eval time=strftime(_time,"%F") | chart count by customerId

sukansingh_0-1675967738296.png

Since these date fields are dynamically getting generated and user can specify any date range So I can not specify | sort -"2023-02-09" .

In this case how to sort by any specific column which is dynamically generated by bucket _time span?

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The user can select the "up arrow" or "down arrow" next to the column name to sort the results by that column.

0 Karma

sukansingh
Explorer

@ITWhisperer , I want to do the sorting through Query as we need to use this chart in Dashboard.

I wonder if Splunk even have this feature.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If it is always the last / latest column, you could try something like this

| sort 0
    [| makeresults
    | addinfo 
    | eval search=strftime(info_max_time-1, "%F")
    | fields search
    | format "" "" "" "" "" ""]

ITWhisperer
SplunkTrust
SplunkTrust

Your chart should work only _time will be in seconds, so I suggest you create a field with time formatted and use that field as the second dimension on the chart.

index="services" statusCode="500" 
| bucket _time span=day 
| eval time=strftime(_time,"%F")
| chart count by customerId, time
| head 10
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...