Dashboards & Visualizations

histogram creation query

surekhasplunk
Communicator

Hi,

I have a query which currently shows the port usage. Now i want to show the same for each month. i.e. for a span of 1 month.
Somehow my code is not working can you please help.

index=bla bla query
Tags (2)
0 Karma
1 Solution

Sukisen1981
Champion

something like this?

    | bin span=1mon _time |  stats count(type) by _time,Value,linkSpeed

View solution in original post

0 Karma

Sukisen1981
Champion

something like this?

    | bin span=1mon _time |  stats count(type) by _time,Value,linkSpeed
0 Karma

surekhasplunk
Communicator

Hi @Sukisen1981

Thanks for the reply my time field is called lastUpdated and the value looks like this : 2019-04-16T04:28:58+02:00

So when i try to put span=1mon it atually gives all records rather than spanning it for 1 month.
Do i need to edit the lastUpdated field to get only the date rather than the full date and time ?

Please help

0 Karma

Sukisen1981
Champion

hi @surekhasplunk
Yes , remember I am applying the bin command on _time , but you have a custom time field, so
| eval lastUpdated=strptime(lastUpdated,"%Y-%m-%d") |eval _time=lastUpdated|bin span=1mon _time |rest of the stuff....

0 Karma
Get Updates on the Splunk Community!

Message Parsing in SOCK

Introduction This blog post is part of an ongoing series on SOCK enablement. In this blog post, I will write ...

Exploring the OpenTelemetry Collector’s Kubernetes annotation-based discovery

We’ve already explored a few topics around observability in a Kubernetes environment -- Common Failures in a ...

Use ‘em or lose ‘em | Splunk training units do expire

Whether it’s hummus, a ham sandwich, or a human, almost everything in this world has an expiration date. And, ...