Splunk Enterprise

How to get the timings on barchart using chart?

fahimparvez02
Loves-to-Learn Lots

Please help me to show the timings on below barchart, i am using chart count over by description to view the file name on graph when i point the mouse pointer to chart, but i couldn't able to provide the timings on xaxis , below are the query and graph

 

index=xxxxx sourcetype = xxxx source="xxxxxx_*.log" |eval description=case(Suspend Like "S","Suspended",Suspend Like "P","Partially-Completed",Suspend Like "C","Completed")|eval File_Name= description."-".TC_File_Name|table _time File_Name TC_File_Name description |chart count(File_Name) over TC_File_Name by description

fahimparvez02_0-1672219289434.png

 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The chart will use 3 things to display, the x-axis, the y-axis and the series. In your case, the x-axis is the TC_File_Name, the series are the descriptions, and the y-axis is the count of combinations of descriptions and TC_File_Name, for each TC_File_Name. Time does not figure in any of these. Therefore, with your current search, you will not be able to show time. Which of the dimensions do you want to remove so that time can be shown?

0 Karma

fahimparvez02
Loves-to-Learn Lots

Thanks for your input, i tried to change as you said but is it possible to  display the field Suspended-TC57* with red color ? please help me on that

 

index= XXXX source="*.log" | eval description=case(Suspend Like "S","Suspended",Suspend Like "C","Completed",Suspend Like "P","Partially-Completed")|eval newField= description."-".TC57_File_Name|timechart span=1h useother=f limit=0 count by newField|sort by newField.

fahimparvez02_0-1672373750047.png

for the below question, i am trying to display the file name with status on it when we point the mouse over the bar,  also i need to display the timings on xaxis, please help me with either one of the above or below dashboard which ever works would be highly appreciated.

 

 

 

0 Karma

fahimparvez02
Loves-to-Learn Lots

Can anyone please help on this?

0 Karma

matt8679
Path Finder

Hi,

Click Format > Chart Overlay > in overlay, click and select field > View as Axis "On"

That might give you want you want.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...