Dashboards & Visualizations

How to create timechart for a stat count result for every single hour for date range selection?

wangkevin1029
Communicator

Hi,  Splunkers, 

 

I have dashboard ,which has a table ouput like  below:

| table _time, column1, column2, column3

time    column1 column2    column3
xxx      a                  1234           1234
xxx      b                  3243           3434
xxx      c                  2343           3434
xxx      a                  1234           1234
xxx      b                  3243           3434
xxx      a                   2343          3434


when I add  |stats count by column1:

| table column1, column2, column3 | stats count by column1

column1     count
a                      3
b                     2
c                     1


I want to have a chart to display this stats count result in different time period, when I select different time/date range,

like when I select 7 days, I want this stats count  columns1 result showing in every single hour for each day for 7 days date range I selected.

I am a splunk beginner, not sure if I describe my requirement clearly...😁

thx in advance.


Kevin

 

Labels (1)
0 Karma

wangkevin1029
Communicator

Sanjay, 

when just add  | stats count by VQ, I have correct statistics return as below:

wangkevin1029_1-1670423501773.png

 

wangkevin1029_0-1670423482882.png

 

0 Karma

wangkevin1029
Communicator

wangkevin1029_0-1670392661935.png

 

also expect to see this bar graph when event tab is selected. 

 

Kevin

0 Karma

SanjayReddy
SplunkTrust
SplunkTrust

Hi @wangkevin1029 

can you try this
| timechart span=1h by column1

0 Karma

wangkevin1029
Communicator

SanjayReddy,

 

I tried  | table _time, column, column2, column3 | stats count by VQ | timechart span=1h count by VQ

or  

| table _time, column, column2, column3 | timechart span=1h count by VQ,   both has statistics tab  0.

 

but when I run  | table _time, column, column2, column3 | stats count by VQ, it has correct return.

 

Kevin

0 Karma

wangkevin1029
Communicator

SanjayReddy,

 

I tried  | table _time, column, column2, column3 | stats count by VQ | timechart span=1h count by VQ

or  

| table _time, column, column2, column3 | timechart span=1h count by VQ,   both has statistics tab  0.

 

but when I run  | table _time, column, column2, column3 | stats count by VQ, it has correct return.

 

Kevin

0 Karma

wangkevin1029
Communicator

wangkevin1029_0-1670422751090.png

 

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...