Hi to everyone,
I am designing an application where my users will potentially need to be able to generate a chart with multiple data series. (depending on their own selection and various options available)
I searched in different posts and i followed this doc with success:
http://docs.splunk.com/Documentation/Splunk/latest/Search/Chartmultipledataseries
This works good, but still i have a small issue with the chart being created in the dashboard, the time period is technically correct but not being shown as would generates the timechart command. (each date section is being shown so too much data with more than a few hours)
A correct chart generated with timechart:
A chart generating with the stat command with multiple series:
My command is the following:
index="rls_index" sourcetype="rls_source" $hostname$ $monitor$ $monitor_label$
bucket _time span=1h | stats max(value) As ValMax, min(value) As ValMin by _time,monitor_label |
eval s1="max min" | makemv s1 | mvexpand s1 | eval yval=case(s1=="max",ValMax,s1=="min",ValMin) | eval series=monitor_label+":"+s1 | convert ctime(_time) as time | xyseries time,series,yval
I needed to add the section "convert ctime(_time) as time" to get a shorter and more readable time format.
Does anyone knows how to generate a chart with the time period being correctly shown like with timechart ?
I had to use the bucket command to limit the amount of data generated, i also would like to put a timerange condition like the timechart command automatically does ? (something like if more than 1 day then bucket 1 hour and so on)
Thank you in advance for any help you could provide.
Long live to Splunk ^^
