How to create a column chart By time Today/Yesterday/LastWeekDay by specific Field value?

[sukansingh]

I want to see the 500 error count for each Customers over time (Today/Yesterday/LastWeekOfDay) So total 3 days.

Below screenshot is Kibana Chart. How can we create same kind of chart in Splunk?

I have tried below timechart query but x axis have time first instead of customerId.

index="services" statusCode="500" | timechart span=1d count by customerId

I have also tried with below Query But I feel Count in response in not correct.

index="services" statusCode="500" | bucket _time span=day | chart count by customerId,_time | head 10

Is there a better way to do it?

[sukansingh]

Thanks @ITWhisperer , This Query is working for me. Now I'm facing a challenge to sort by specific column let say 3rd column.

index="services" statusCode="500" | bucket _time span=day | eval time=strftime(_time,"%F") | chart count by customerId

Since these date fields are dynamically getting generated and user can specify any date range So I can not specify | sort -"2023-02-09" .

In this case how to sort by any specific column which is dynamically generated by bucket _time span?

[ITWhisperer]

The user can select the "up arrow" or "down arrow" next to the column name to sort the results by that column.

[sukansingh]

@ITWhisperer , I want to do the sorting through Query as we need to use this chart in Dashboard.

I wonder if Splunk even have this feature.

[ITWhisperer · Accepted solution]

If it is always the last / latest column, you could try something like this

| sort 0
    [| makeresults
    | addinfo 
    | eval search=strftime(info_max_time-1, "%F")
    | fields search
    | format "" "" "" "" "" ""]

[ITWhisperer]

Your chart should work only _time will be in seconds, so I suggest you create a field with time formatted and use that field as the second dimension on the chart.

index="services" statusCode="500" 
| bucket _time span=day 
| eval time=strftime(_time,"%F")
| chart count by customerId, time
| head 10