Dashboards & Visualizations

How to obtain a visualisation based on time (x-axis) for a multi series search (table)?

zebu14
Explorer

Hello,

I am using a table type search with visualisation with multiple fields to render.
The purpose of this search is to match two events in a transaction (incoming file and outgoing file) and calculate some infos (bandwidth, duration...)

My search is :

index="" sourcetype= | transaction file_component maxpause=5m |eval debit=Size/duration | table file_component,Size,duration,debit

This give me a multi series visualisation in which "file_component" (the transaction id) is the x-axis, so events are sorted with transaction id but not with time.

I tried to add:

index="" sourcetype= | transaction file_component maxpause=5m |eval debit=Size/duration | table file_component,Size,duration,debit,_time | sort by _time

This worked for sorting the results by time, but X-axis is still based on transaction id and I can't find the date and time of a transfer by just hovering the mouse on the graphs.

alt text

Any idea?

Thanks

0 Karma
1 Solution

renjith_nair
Legend

Hi @zebu14,

You could get _time on x-axis by changing the order ie. index="" sourcetype= | transaction file_component maxpause=5m |eval debit=Size/duration | table _time ,file_component,Size,duration,debit
However, normally time based charting is done based on aggregation function using stats/timechart

---
What goes around comes around. If it helps, hit it with Karma :slightly_smiling_face:

View solution in original post

0 Karma

renjith_nair
Legend

Hi @zebu14,

You could get _time on x-axis by changing the order ie. index="" sourcetype= | transaction file_component maxpause=5m |eval debit=Size/duration | table _time ,file_component,Size,duration,debit
However, normally time based charting is done based on aggregation function using stats/timechart

---
What goes around comes around. If it helps, hit it with Karma :slightly_smiling_face:
0 Karma

zebu14
Explorer

Thanks for the tip.
I usually use timechart function, but I'm still a beginner and I still don't manage the use of timechart with multiple parameters

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...