Splunk Search

How to create a line chart with received time on Y axis and date on X axis?

Curiuu
Engager

I'm looking to create a line chart like the attached picture. The data points would be the time a file is received, there are 5 different files, so it would be a multi-line chart. My most recent attempt was using someone's example of this query. It does work to an extent, but the received time is converted to a decimal which isn't the best for my use case.

| eval t=split(strftime(_time, "%H:%M:%S"), ":")
| eval h=mvindex(t,0), m=mvindex(t,1), s=mvindex(t,2)
| eval v=(h)+(m/100)
| bin _time span=1d
| chart max(v) over _time by job

 

Labels (1)
0 Karma

woodcock
Esteemed Legend

Something like this:

index=_internal
| eval date_hour = strftime(_time, "%H")
| bin _time span=1d
| stats count BY date_hour _time
| sort 0 - count
| timechart span=1d first(date_hour) AS busiest_hour

0 Karma

somesoni2
Revered Legend

Try something like this

| eval t=split(strftime(_time, "%H:%M:%S"), ":")
| eval h=mvindex(t,0), m=mvindex(t,1), s=mvindex(t,2)
| eval v=(h)+(m/100)
| eval day=strftime(_time,"%F")
| chart max(v) over day by job
0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...