Dashboards & Visualizations

query to chart total duration by Jobname daily for over a period of time

sjafferali
Explorer

I wrote the belong query to chart total duration by Jobname daily for over a period of time
the results comes up with 1 day only.
any help is much appreciated.

index="dnr_ecc"  jobname="*IC*HV_TREX" | bucket _time span=1d | stats max(total_run_time) by jobname
Tags (1)
0 Karma

woodcock
Esteemed Legend

What is wrong with this:

index="dnr_ecc" jobname="*IC*HV_TREX"
| timechart span=1d max(total_run_time) BY jobname
0 Karma

somesoni2
Revered Legend

Your stats command is not doing aggregation based on _time, hence it's giving for overall period, instead of each day. Try like this

index="dnr_ecc"  jobname="*IC*HV_TREX" | bucket _time span=1d | stats max(total_run_time) by _time jobname

Other variations that you can try are

index="dnr_ecc"  jobname="*IC*HV_TREX" | timechart span=1d max(total_run_time) by jobname

index="dnr_ecc"  jobname="*IC*HV_TREX" | eval date=strftime(_time,"%m/%d/%Y") | chart max(total_run_time) by jobname date

sjafferali
Explorer

The query I wrote:

  index="dnr_ecc" jobname="*IC*HV_TREX" |
    bucket _time span=1d | dedup jobname jobcount sortby -_time |
    chart max(total_run_time) over _time by jobname
0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...