Splunk Search

How to create a line chart with received time on Y axis and date on X axis?

Curiuu
Engager

I'm looking to create a line chart like the attached picture. The data points would be the time a file is received, there are 5 different files, so it would be a multi-line chart. My most recent attempt was using someone's example of this query. It does work to an extent, but the received time is converted to a decimal which isn't the best for my use case.

| eval t=split(strftime(_time, "%H:%M:%S"), ":")
| eval h=mvindex(t,0), m=mvindex(t,1), s=mvindex(t,2)
| eval v=(h)+(m/100)
| bin _time span=1d
| chart max(v) over _time by job

 

Labels (1)
0 Karma

woodcock
Esteemed Legend

Something like this:

index=_internal
| eval date_hour = strftime(_time, "%H")
| bin _time span=1d
| stats count BY date_hour _time
| sort 0 - count
| timechart span=1d first(date_hour) AS busiest_hour

0 Karma

somesoni2
Revered Legend

Try something like this

| eval t=split(strftime(_time, "%H:%M:%S"), ":")
| eval h=mvindex(t,0), m=mvindex(t,1), s=mvindex(t,2)
| eval v=(h)+(m/100)
| eval day=strftime(_time,"%F")
| chart max(v) over day by job
0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...