index=* namespace="dk1017-j" sourcetype="kube:container:kafka-clickhouse-snapshot-writer" message="*Snapshot event published*" AND message="*dbI-WAR*" AND message="*2022-03-29*" AND message="*"
|fields message
|rex field=_raw "\s+date=(?<BusDate>\d{4}-\d{2}-\d{2})"
|rex field=_raw "sourceSystem=(?<Source>[^,]*)"
|rex field=_raw "entityType=(?<Entity>\w+)"
|rex field=_raw "\"timestamp\":\"(?<Time>\d{4}-\d{2}-\d{2}[T]\d{2}:\d{2})"
|sort Time desc
|dedup Time
|table Source, BusDate, Entity, Time
output of above command is below -------------------
Source BusDate Entity Time
dbI-WAR | 2022-03-29 | BOOKING | 2022-03-30T02:05 |
dbI-WAR | 2022-03-29 | DATA_QUALITY_REPORTS | 2022-03-30T02:04 |
dbI-WAR | 2022-03-29 | DATA_QUALITY_ENTITIES | 2022-03-30T02:03 |
dbI-WAR | 2022-03-29 | COMBINED_POSITION_NORMALIZED | 2022-03-30T01:40 |
dbI-WAR | 2022-03-29 | COMBINED_POSITION | 2022-03-30T01:36 |
dbI-WAR | 2022-03-29 | DATA_QUALITY_ENTITIES | 2022-03-30T01:35 |
dbI-WAR | 2022-03-29 | DEPOSIT | 2022-03-30T01:34 |
dbI-WAR | 2022-03-29 | DATA_QUALITY_REPORTS | 2022-03-30T01:33 |
dbI-WAR | 2022-03-29 | DATA_QUALITY_ENTITIES | 2022-03-30T00:43 |
dbI-WAR | 2022-03-29 | NEXT_BUSINESS_DAYS | 2022-03-29T23:49 |
question - i would like to line chart
x axis should be date as date is same for all
&
y axis should be time
This doesn't sound like a very interesting chart. If all the dates are the same there will be a single point for each series, which by the way you haven't specified what this will be. Please can you clarify what it is you are trying to do here?
i just wanted to explore chart command or option
could you please share some useful command how we convert some data into chart
It usually works the other way around - you need to decide what it is you are trying to show with a chart, then you look to see if there is an appropriate chart type available, then you work out what the search should be to show you the information you want from your data.