Splunk IT Service Intelligence

Chart Split in N days span

sandeepshah81
Explorer

Hi ,

I have a query where I am trying to use Chart funtion to show for a particular application which have multiple versions of the same application installed show number of PC's that particular application got installed with InstallDate field under X-Axis and Y Axis shows the numbers

I am able to acheive it .. But I do not want the field which is in my X-Axis to show fr all the dates, instead it should show in 3 days period like example: X-axis should say 1march, 4march, 7th march and y-axis should say overall sum of the installed count of pc's per application version

|chart count(host) as #Hosts over InstallDate by DisplayVersion

Here InstallDate is my x-axis fields..

0 Karma

vnravikumar
Champion

hi
try like

| eval _time= InstallDate | timechart count(host) as #Hosts span=3d by DisplayVersion
0 Karma

vnravikumar
Champion

if InstallDate is not in epoch convert it and give a try

0 Karma

sandeepshah81
Explorer

It worked to get me that difference like date shows in 3 days gap.. but data under each displayVersion is 0.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.