Splunk Search

How to get other field on x-axis other than _time?

bollam
Path Finder

I'm fetching data by hitting an API, and the data I get will be a single event which consists of cpu_used and corresponding time(cpu_time).
The cpu_time will be in the format (1531981800). I need to plot a timechart based on the cpu_used by cpu_time but not _time.
While i'm running following query I'm getting _time in the x-axis but which should suppose to be cpu_used and cpu_used on the y-axis.

x-axis values as follows: i531981800, 1531982400, 1531982700, 1531983000 1531983600
and corresponding y-axis values: 25, 40, 30, 55, 70

Query:
index=sai_core source="saii"
| eval mytime=strftime(cpu_time, "%Y-%m-%d %H:%M:%S")
| timechart span=1h values(cpu_used) by mytime

Tags (2)
0 Karma

Shan
Builder

@bollam

Below one is a test query i have provided.
What you need to do is .. Just assign the calculated field mytime to the _time. example | eval _time = mytime .
Then you will get your own time field value in the timechart.

| makeresults 
| eval mytrimexaxis =mvappend("1531981800","1531982400","1531982700","1531983000","1531983600") 
| eval mytime=strftime(mytrimexaxis, "%Y-%m-%d %H:%M:%S")
| eval cpu_usedyaxis  =mvappend("25","40","30","55","70")
| eval _time = mytime      
| mvexpand mytrimexaxis 
| mvexpand cpu_usedyaxis
| timechart span=1h values(cpu_usedyaxis)

If your query is resolved and got the solution ..
Please accept the answer..

0 Karma

bollam
Path Finder

@Shan,Thanks for the quick response! I gave these four values as an instance, i have got hundreds of such values (cpu_time and cpu_used) in a single event, How do I achieve desired results when having such bunch of values, Can you assist on this can I also get the results using index rather than makeresults command?

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...