Splunk Search

How to create chart from 2 different fields

spisiakmi
Contributor

Hi. I have a table with 3 columns. A B C. A=time, B=run, C=wait
Explenation of the table: the process runs from A2 (11.03.2015 14:54:32) and the status run=1. The status wait=0. The process ends at 11.03.2015 14:56:28 and the status run=0 and status wait=1. The run process takes 116s. The wait process takes 42s. The whole sequence repeats. Only delta of the time values differs.

time    run wait
11.03.2015 14:54:32 1   0
11.03.2015 14:56:28 0   1
11.03.2015 14:57:10 1   0
11.03.2015 14:59:06 0   1
11.03.2015 14:59:58 1   0
11.03.2015 15:01:57 0   1
11.03.2015 15:02:15 1   0

How can I build such a chart, which will have:
x-axis: column A (time) from the table
y-axis: boolean 0 or 1.
and columns B and C will be displayed in time (column chart). The width of each run or wait column should depends on, how many seconds take the run or wait process. There should be no blank space between the columns in the chart, because the whole process (run wait run wait ...) is fowing continuously.
Can anybody have any idea, how to fix it, please?

0 Karma
1 Solution

cpetterborg
SplunkTrust
SplunkTrust

Does something like this do what you want?:

<your search> 
| timechart values(run) as x1, values(wait) as x2 span=1s 
| filldown x1, x2

View solution in original post

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

Does something like this do what you want?:

<your search> 
| timechart values(run) as x1, values(wait) as x2 span=1s 
| filldown x1, x2
0 Karma

spisiakmi
Contributor

Hi, yes, you are right. It is working. In fact, before that, I need to adjust the _time like this:
| eval NewTime=strptime(time,"%d.%m.%Y %H:%M:%S")
| eval _time=NewTime
| timechart values(run) as x1, values(wait) as x2 span=1s
| filldown x1, x2

thank you very much

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...