Splunk Search

How to get other field on x-axis other than _time?

bollam
Path Finder

I'm fetching data by hitting an API, and the data I get will be a single event which consists of cpu_used and corresponding time(cpu_time).
The cpu_time will be in the format (1531981800). I need to plot a timechart based on the cpu_used by cpu_time but not _time.
While i'm running following query I'm getting _time in the x-axis but which should suppose to be cpu_used and cpu_used on the y-axis.

x-axis values as follows: i531981800, 1531982400, 1531982700, 1531983000 1531983600
and corresponding y-axis values: 25, 40, 30, 55, 70

Query:
index=sai_core source="saii"
| eval mytime=strftime(cpu_time, "%Y-%m-%d %H:%M:%S")
| timechart span=1h values(cpu_used) by mytime

Tags (2)
0 Karma

Shan
Builder

@bollam

Below one is a test query i have provided.
What you need to do is .. Just assign the calculated field mytime to the _time. example | eval _time = mytime .
Then you will get your own time field value in the timechart.

| makeresults 
| eval mytrimexaxis =mvappend("1531981800","1531982400","1531982700","1531983000","1531983600") 
| eval mytime=strftime(mytrimexaxis, "%Y-%m-%d %H:%M:%S")
| eval cpu_usedyaxis  =mvappend("25","40","30","55","70")
| eval _time = mytime      
| mvexpand mytrimexaxis 
| mvexpand cpu_usedyaxis
| timechart span=1h values(cpu_usedyaxis)

If your query is resolved and got the solution ..
Please accept the answer..

0 Karma

bollam
Path Finder

@Shan,Thanks for the quick response! I gave these four values as an instance, i have got hundreds of such values (cpu_time and cpu_used) in a single event, How do I achieve desired results when having such bunch of values, Can you assist on this can I also get the results using index rather than makeresults command?

0 Karma
Get Updates on the Splunk Community!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...