Splunk Search

How to create chart from 2 different fields

spisiakmi
Builder

Hi. I have a table with 3 columns. A B C. A=time, B=run, C=wait
Explenation of the table: the process runs from A2 (11.03.2015 14:54:32) and the status run=1. The status wait=0. The process ends at 11.03.2015 14:56:28 and the status run=0 and status wait=1. The run process takes 116s. The wait process takes 42s. The whole sequence repeats. Only delta of the time values differs.

time    run wait
11.03.2015 14:54:32 1   0
11.03.2015 14:56:28 0   1
11.03.2015 14:57:10 1   0
11.03.2015 14:59:06 0   1
11.03.2015 14:59:58 1   0
11.03.2015 15:01:57 0   1
11.03.2015 15:02:15 1   0

How can I build such a chart, which will have:
x-axis: column A (time) from the table
y-axis: boolean 0 or 1.
and columns B and C will be displayed in time (column chart). The width of each run or wait column should depends on, how many seconds take the run or wait process. There should be no blank space between the columns in the chart, because the whole process (run wait run wait ...) is fowing continuously.
Can anybody have any idea, how to fix it, please?

0 Karma
1 Solution

cpetterborg
SplunkTrust
SplunkTrust

Does something like this do what you want?:

<your search> 
| timechart values(run) as x1, values(wait) as x2 span=1s 
| filldown x1, x2

View solution in original post

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

Does something like this do what you want?:

<your search> 
| timechart values(run) as x1, values(wait) as x2 span=1s 
| filldown x1, x2
0 Karma

spisiakmi
Builder

Hi, yes, you are right. It is working. In fact, before that, I need to adjust the _time like this:
| eval NewTime=strptime(time,"%d.%m.%Y %H:%M:%S")
| eval _time=NewTime
| timechart values(run) as x1, values(wait) as x2 span=1s
| filldown x1, x2

thank you very much

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...

Catalog Is Now Generally Available on Splunk Cloud Platform

A Unified View of Your Data  Security logs, application events, business data, and historical telemetry often ...

Your Path to AgenticOps: AI Experiences for Every Splunk Practitioner

Your Path to AgenticOps: AI Experiences for Every Splunk Practitioner   Watch on demand us for a demo-driven ...