Splunk Search

How to plot Time (in hours) in Y-axis and Date in X-axis?

smhsplunk
Communicator

So I am trying to plot Hours in Y axis and the Time in the X-axis (the time is the first time events related to a particular host appeared).
Please note I am accumulating time of each source (first and last event) and adding them to make total time of host (yes, I want to find exact time).

So far I have this, it gives me barplot with time (not so sure about the last line)

index=main host="*"
                | stats earliest(_time) as First latest(_time) as Last by source, host
                | eval difference=Last-First 
                | stats sum(difference) as total_difference by host
        | eval total_difference = total_difference/3600
                | chart max(total_difference) by host, First

I don't have date on my X-axis
I would like each host to have a different color and would like to order the hosts by date

0 Karma

somesoni2
Revered Legend

This should do it.

index=main host="*"
                 | stats earliest(_time) as _time latest(_time) as Last by source, host
                 | eval difference=Last-_time 
                 | stats min(_time) as _time sum(difference) as total_difference by host
         | eval total_difference = total_difference/3600
             | table _time host total_difference

Try this as well

index=main host="*"
                 | stats earliest(_time) as _time latest(_time) as Last by source, host
                 | eval difference=Last-_time 
                 | stats min(_time) as _time sum(difference) as total_difference by host
         | eval total_difference = total_difference/3600
             | table _time host total_difference | xyseries _time host total_difference
0 Karma

smhsplunk
Communicator

Perhaps this is working

index=main host="*"
                | stats earliest(_time) as First latest(_time) as Last by source, host | eval Date = strftime(First, "%Y-%m-%d")
               | eval difference= Last-First | eval difference=difference/3600 | chart eval(sum(difference)) as total_difference over Date by host
0 Karma

hunters_splunk
Splunk Employee
Splunk Employee

Hi smhsplunk,

I think the last line in your query should be:

...
| chart max(total_difference) over First by host

Please see if it works. Thanks!
Hunter Shen

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...