Splunk Search

How to create a time chart with row data?

UMDTERPS
Communicator

I have search that runs every day that populates a CSV that looks like this (I have more sources, but wanted to keep it more simple to explain):

SourceTotalServerWorkstationOtherUnknowndate
norton7351785425101612548722
nessus 85788299111612548722



I would like a time graph to show each source over time, is this possible? I've tried a few methods, but can't seem to manipulate the data to get it to work right.  I know the data will have to be converted using SPL like this  |fieldformat date = strftime(date, "%m/%d/%Y").

Any ideas how how to make a time graph by source over time? 

Thanks!

Labels (4)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

I think you already have everything you need.  There's no need to convert the date field because it's already in epoch form.  You do need to assign date to _time, however.  Try this query.

| inputlookup mycsv.csv
| eval _time = date
| timechart max(Total) as Total by Source
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

I think you already have everything you need.  There's no need to convert the date field because it's already in epoch form.  You do need to assign date to _time, however.  Try this query.

| inputlookup mycsv.csv
| eval _time = date
| timechart max(Total) as Total by Source
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

UMDTERPS
Communicator

Works! Thanks!

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!