We have jobs running everyday and I want to do a timechart to show the start time of the job for each day. I have data populated if I put it in a stats table but trying to get a timechart is not working. Do I need to adjust the format of the time data in order to use this properly?
What I want is to show the start time over each day to identify delays.
Here is the stats data that works.
rest of search....| stats values(Tier1StartTime) as T1Start, values(Tier2StartTime), values(Tier3StartTime) by Tier1, Tier2, Tier3
| stats count
| eval raw="2019/09/01,2019/10/01"
| makemv delim="," raw
| mvexpand raw
| eval raw=strptime(raw,"%Y/%m/%d")
| makecontinuous span=1d raw
| eval _time=raw
| eval time_args1="+".(random() % (60*24) +1)."m"
| eval time_args2="+".(random() % (60*24) +1)."m"
| eval time_args3="+".(random() % (60*24) +1)."m"
| eval tier1=relative_time(raw,time_args1)
| eval tier2=relative_time(raw,time_args2)
| eval tier3=relative_time(raw,time_args3)
| fieldformat tier1 = strftime(tier1,"%H:%M")
| fieldformat tier2 = strftime(tier2,"%H:%M")
| fieldformat tier3 = strftime(tier3,"%H:%M")
| table _time,tier*
`comment("this is sample data")`
Hi, this is sample data.
_time tier1 tier2 tier3
2019/09/01 00:52 07:20 16:01
2019/09/02 16:36 15:07 16:55
2019/09/03 14:35 13:02 22:40
2019/09/04 21:04 18:29 18:00
2019/09/05 10:30 16:44 18:17
2019/09/06 12:02 22:08 10:39
Since the Y-axis of the line chart is only numbers, it cannot be displayed as it is.
So, in summary, what about queries like this?
| stats count
| eval raw="2019/10/01,2019/10/14"
| makemv delim="," raw
| mvexpand raw
| eval raw=strptime(raw,"%Y/%m/%d")
| makecontinuous span=1d raw
| eval _time=raw
| eval time_args1="+".(random() % (60*12) +1)."m"
| eval time_args2="+".(random() % (60*12) +1)."m"
| eval time_args3="+".(random() % (60*12) +1)."m"
| eval tier1=relative_time(raw,time_args1)
| eval tier2=relative_time(raw,time_args2)
| eval tier3=relative_time(raw,time_args3)
| table _time,tier*
`comment("this is sample data")`
| foreach tier*
[ eval <<FIELD>> = round ((<<FIELD>> - _time) / 3600 ,1)]
try chart command .