Graph displays incorrectly with timechart function

[Hegemon76]

Here is my search string:

product=Windows EventCode=645 OR EventCode=4741 | timechart span=1w count | eval Severe=if(count>25,count,0) | eval High=if(count<=25 AND count>20,count, 0)| eval Moderate = if(count<=20 AND count>15,count,0) | eval Low = if(count<=15 AND count>7,count, 0) | eval Very Low = if(count<=7 AND count>0,count, 0)| rename _time as Date, count as Count |convert timeformat="%Y-%m-%d" ctime(Date)

I have the corresponding XML but it isn't letting me post it. It works....all the colors work.

These two are correct in terms of what I'm going for however when the visualization displays there is a count "bar" that corresponds directly to the other bars come out to. All I wanted to do was have a chart with different colors than blue to distinguish data by week but it seems like this is impossible based on everything I've read. You have to use timechart and timechart seems to only display data with a count field that makes the whole thing look like trash.

Any help would be great!

Thanks

[Hegemon76]

So it works! This is great! Thanks niketnilay

However.....

How can I increase the size of the horizontal bar chart lines (or vertical the type of chart doesn't matter) ? Keep in mind I changed your script to this:

product=Windows EventCode=645 OR EventCode=4741
| bin _time span=1w
| stats count by _time
| eval Status=case(count>25,"Severe",
count<=25 AND count>20,"High",
count<=20 AND count>15,"Moderate",
count<=15 AND count>7,"Low",
count<=7 AND count>0,"Very Low",
true(), 0)
| timechart span="1h" sum(count) as Count by Status
| eval _time=strptime(strftime(_time,"%Y/%m/%d"),"%Y/%m/%d")
| fillnull value=0

The lines are incredibly small now (graphically) and clicking "format virtualization" to stacked or non stack doesn't do anything anymore. One issue begets another is seems.

[niketn]

That is because you missed out changing span="1w" inside timechart command.

| timechart span="1w" sum(count) as Count by Status 

Just FYI, for posting Image, you can upload the same to any image sharing site and then use the link using Image Button Ctrl+G.

[Hegemon76]

Ya I tried that and it just says I don't have enough karma.

Simple fix made the chart work. This is great thanks! I'm curious what removed the "count" part though?

Was is the "|fillnull value=0" or the entirety of what you did. That was driving me nuts for around 2 days trying to figure this out.

[niketn]

The timechart command with split by Status field generates the count of Status and names the fields as the Status Name ie Low, Moderate etc. So there is not Count field.

fillnull just fills 0 instead of null to represent numeric data in graph.

Glad you found your solution. Do up vote the comments that helped 🙂

I am surprise that Link can not be attached. Are you sure you are not trying to use the Attachment button Ctrl+U which looks like a Paper Clip, as that is restricted by Karma points. In any case you can also directly paste the link of image sharing site where the image is uploaded just in case.

Have a great day ahead!

[Hegemon76]

Thanks for your help!

[Hegemon76]

I probably need to open a new question but that doesn't work for stats count or chart count.

[Hegemon76]

I need more karma points to post images.

😞

[niketn · Accepted solution]

@Hegemon76, please try out the following run anywhere search example based on Splunk's _internal index. You can change | bin _time span=1w and | eval _time=strptime(strftime(_time,"%Y/%m/%d"),"%Y/%m/%d") as per your need.

index=_internal sourcetype=splunkd log_level!=INFO 
| bin _time span=1h 
| stats count by _time 
| eval Status=case(count>25,"Severe",
    count<=25 AND count>20,"High",
    count<=20 AND count>15,"Moderate",
    count<=15 AND count>7,"Low",
    count<=7 AND count>0,"Very Low",
    true(), 0) 
| timechart span="1h" sum(count) as Count by Status 
| eval _time=strptime(strftime(_time,"%Y/%m/%d %H"),"%Y/%m/%d %H")
| fillnull value=0

[niketn]

@Hegemon76 can you post code using code button i.e. button with 101010 on it (shortcut is CTRL+K). Also if possible can you upload screen mock up of what you have and what is the issue? You can upload to any image sharing site and then post the image link using Image button (Shortcut Ctrl+G).

[Hegemon76]

product=Windows EventCode=645 OR EventCode=4741 | timechart span=1w count| eval Severe=if(count>25,count,0) | eval High=if(count<=25 AND count>20,count, 0)| eval Moderate = if(count<=20 AND count>15,count,0) | eval Low = if(count<=15 AND count>7,count, 0) | eval Very Low = if(count<=7 AND count>0,count, 0)| rename _time as Date |convert timeformat="%Y-%m-%d" ctime(Date)

{"Severe":0xFF0000,"High":0xff8000,"Moderate":0xFFFF00,"Low":0x00FF00,"Very Low":0x0000ff}