Splunk Search

How to plot Time (in hours) in Y-axis and Date in X-axis?

smhsplunk
Communicator

So I am trying to plot Hours in Y axis and the Time in the X-axis (the time is the first time events related to a particular host appeared).
Please note I am accumulating time of each source (first and last event) and adding them to make total time of host (yes, I want to find exact time).

So far I have this, it gives me barplot with time (not so sure about the last line)

index=main host="*"
                | stats earliest(_time) as First latest(_time) as Last by source, host
                | eval difference=Last-First 
                | stats sum(difference) as total_difference by host
        | eval total_difference = total_difference/3600
                | chart max(total_difference) by host, First

I don't have date on my X-axis
I would like each host to have a different color and would like to order the hosts by date

0 Karma

somesoni2
Revered Legend

This should do it.

index=main host="*"
                 | stats earliest(_time) as _time latest(_time) as Last by source, host
                 | eval difference=Last-_time 
                 | stats min(_time) as _time sum(difference) as total_difference by host
         | eval total_difference = total_difference/3600
             | table _time host total_difference

Try this as well

index=main host="*"
                 | stats earliest(_time) as _time latest(_time) as Last by source, host
                 | eval difference=Last-_time 
                 | stats min(_time) as _time sum(difference) as total_difference by host
         | eval total_difference = total_difference/3600
             | table _time host total_difference | xyseries _time host total_difference
0 Karma

smhsplunk
Communicator

Perhaps this is working

index=main host="*"
                | stats earliest(_time) as First latest(_time) as Last by source, host | eval Date = strftime(First, "%Y-%m-%d")
               | eval difference= Last-First | eval difference=difference/3600 | chart eval(sum(difference)) as total_difference over Date by host
0 Karma

hunters_splunk
Splunk Employee
Splunk Employee

Hi smhsplunk,

I think the last line in your query should be:

...
| chart max(total_difference) over First by host

Please see if it works. Thanks!
Hunter Shen

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...