How to create a report from timechart with time on the Y-Axis?

[ZD]

Hello,

I would like to create a report about our daily exports. For each day I want to see, when the export started and when it ended. So on the X-axis I want to have a date, on Y-Axis the time. It should look like this:

Additionally I would like to add a "Limit" line to show, when the export has to be ready at the latest. 

How can I add the time on the Y-axis and a "limit" line on it?

Thank you, Zuz

[gcusello]

Hi @ZD,

sorry but there's something that I don't understand:

you have on the X-axis the time (there are the days) and also in the Y-axis there's the time (hours)?

in this way how do you display the value? you haven't a three dimension chart.

Usually in Y-axis there's the value to display.

About the limit, you have to add at the end of your search:

| eval value=10

where value is the field that you're displaying (usually the field in the timechart command),

then in the panel, you have to enable overlay using this field.

Ciao.

Giuseppe

[a_vobard]

Hello @gcusello ,

So I want to have time on one axis and the date on the another.

[ITWhisperer]

Along with what @gcusello  and @bowesmana  said, the other thing you can't do with standard charts, is have different parts of the same series coloured differently (e.g. in your example of what it "should look like" where the end time is beyond 10:00 the columns are different to those where the end time is before 10:00).

[bowesmana]

@ZD 

There is a visualisation - Region Chart

https://splunkbase.splunk.com/app/4911

where you can technically colour each section in detail, so you could use colours to identify start/end and also the end that extends over expected time as a different colour.

However, you still face the same limitation of the styling of the Y-axis in that it has to be a number, so you can't do thinks like 8:00, 8:30, 9:00. You can do 800, 900 etc, but you can't express minutes sensibly.

[bowesmana]

See also this post for how to handle minutes on the y-axis

https://community.splunk.com/t5/Splunk-Search/Charting-completion-time-on-daily-basis/m-p/630858#M21...

[gcusello]

Hi @a_vobard ,

as me and @bowesmana said, for your requirement you need a three dimension chart not a simple two dimensions chart.

You could analyze the opportunity to use a Bubblechart diagram (https://splunkbase.splunk.com/app/1603) or a puchcard diagram (https://splunkbase.splunk.com/app/3129) or a 3D Scatterplot diagram (https://splunkbase.splunk.com/app/3138) or another type of 3D diagram or a Trellis.

Ciao.

Giuseppe

[bowesmana]

It's not possible with a column chart to show a 'range' of a value, i.e. the top of the bar will always be the end time, but it's not possible to make the bottom of the bar represent a variable start time.

The y-axis will need to be a number and cannot be a time in the format 7:00, 8:00 etc.

It can be 7, 8, 9 and so on.

If your starting time is constant, then you can set the Y-axis minimum to that value and then the end time can show the height. Simply adding an eval of the expected end time is done with the eval statement, e.g. v=10