Splunk Search

How to create a bar chart to count how many events were created and completed over last 6 months (span 1 week)?

Accak
Path Finder

I managed to count how many events were created and completed (tickets) in last weeks (last 6 months).
You can see the piece of output below
alt text

As you can see tickets can be opened and closed in different weeks, and I want to get chart like this (it can be just number of completed and opened in bars, without line):

alt text

I can do this:

append [ | gentimes start=-180 | bin span=1w endtime | stats count by endtime | eval year_week=strftime(endtime, "%Y-%U") | table year_week| reverse ] |

And I will get additional column with last weeks. But what next?

Any ideas how do it better?

Tags (4)
0 Karma

Accak
Path Finder

Ok, it was easier than I thougt (nobie here)

I just searched for all events that are opened and closed in the same week, and then just dedup it. So the output now looks like this:

alt text

Now I have problems with the chart. Any ideas how I can put this values: open_during_week, complete_during_week over week_number_for_open?

0 Karma

woodcock
Esteemed Legend

Again, I do not understand your question. what do you mean by "put"?

0 Karma

Accak
Path Finder

I mean: "How to populate chart like above, with values open_during_week, complete_during_week over week_number_for_open?"

0 Karma

woodcock
Esteemed Legend

What search generated the output in your last update?

0 Karma

woodcock
Esteemed Legend

I don't quite get what you are trying to do but have you checked out the concurrency command?

https://docs.splunk.com/Documentation/Splunk/6.5.3/SearchReference/Concurrency

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...