Splunk Search

How to create chart from 2 different fields

spisiakmi
Communicator

Hi. I have a table with 3 columns. A B C. A=time, B=run, C=wait
Explenation of the table: the process runs from A2 (11.03.2015 14:54:32) and the status run=1. The status wait=0. The process ends at 11.03.2015 14:56:28 and the status run=0 and status wait=1. The run process takes 116s. The wait process takes 42s. The whole sequence repeats. Only delta of the time values differs.

time    run wait
11.03.2015 14:54:32 1   0
11.03.2015 14:56:28 0   1
11.03.2015 14:57:10 1   0
11.03.2015 14:59:06 0   1
11.03.2015 14:59:58 1   0
11.03.2015 15:01:57 0   1
11.03.2015 15:02:15 1   0

How can I build such a chart, which will have:
x-axis: column A (time) from the table
y-axis: boolean 0 or 1.
and columns B and C will be displayed in time (column chart). The width of each run or wait column should depends on, how many seconds take the run or wait process. There should be no blank space between the columns in the chart, because the whole process (run wait run wait ...) is fowing continuously.
Can anybody have any idea, how to fix it, please?

0 Karma
1 Solution

cpetterborg
SplunkTrust
SplunkTrust

Does something like this do what you want?:

<your search> 
| timechart values(run) as x1, values(wait) as x2 span=1s 
| filldown x1, x2

View solution in original post

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

Does something like this do what you want?:

<your search> 
| timechart values(run) as x1, values(wait) as x2 span=1s 
| filldown x1, x2
0 Karma

spisiakmi
Communicator

Hi, yes, you are right. It is working. In fact, before that, I need to adjust the _time like this:
| eval NewTime=strptime(time,"%d.%m.%Y %H:%M:%S")
| eval _time=NewTime
| timechart values(run) as x1, values(wait) as x2 span=1s
| filldown x1, x2

thank you very much

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...