Splunk Search

How to create a time chart with row data?

UMDTERPS
Communicator

I have search that runs every day that populates a CSV that looks like this (I have more sources, but wanted to keep it more simple to explain):

SourceTotalServerWorkstationOtherUnknowndate
norton7351785425101612548722
nessus 85788299111612548722



I would like a time graph to show each source over time, is this possible? I've tried a few methods, but can't seem to manipulate the data to get it to work right.  I know the data will have to be converted using SPL like this  |fieldformat date = strftime(date, "%m/%d/%Y").

Any ideas how how to make a time graph by source over time? 

Thanks!

Labels (4)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

I think you already have everything you need.  There's no need to convert the date field because it's already in epoch form.  You do need to assign date to _time, however.  Try this query.

| inputlookup mycsv.csv
| eval _time = date
| timechart max(Total) as Total by Source
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

I think you already have everything you need.  There's no need to convert the date field because it's already in epoch form.  You do need to assign date to _time, however.  Try this query.

| inputlookup mycsv.csv
| eval _time = date
| timechart max(Total) as Total by Source
---
If this reply helps you, Karma would be appreciated.

UMDTERPS
Communicator

Works! Thanks!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...