Splunk Search

How to plot a stacked column chart with TIME taken from data in a CSV file as the y-axis ?

harshal_chakran
Builder

Hi,
I have a csv file as shown below.

DATETIME  ACTIVITIES    TIME
1Jan      Activity1 0:02:00
1Jan    Activity2   2:45:00
1Jan    Activity3   0:00:05
1Jan    Activity4   0:00:01
1Jan    Activity5   3:00:00
1Jan    Activity6   1:15:00
1Jan    Activity7   0:30:00
1Jan    Activity8   0:00:30
1Jan    Activity9   0:30:00
1Jan    Activity10   0:10:00
1Jan    Activity11   0:50:00
1Jan    Activity12   0:03:00
2Jan    Activity1   0:01:18
2Jan    Activity2   1:23:08
2Jan    Activity3   0:00:05
2Jan    Activity4   0:00:00
2Jan    Activity5   2:49:53
2Jan    Activity6   1:02:41
2Jan    Activity7   0:29:33
2Jan    Activity8   0:00:14
2Jan    Activity9   1:09:34
2Jan    Activity10   0:02:47
2Jan    Activity11   0:46:03
2Jan    Activity12   0:02:01

I have converted the TIME column to Splunk's TIMEFORMAT, Then I was trying to plot a stacked chart with xyseries command like:
xyseries DATETIME ACTIVITIES TIME.

But its doesnt plots the graph as Splunk is not able to identify the TIME, and plot it.
This is how I want to display the result as following picture:
alt text

The Y axis labels should be with respect to time format.
Please Help..

Tags (4)
0 Karma

btt
Path Finder

Hi,
... |convert timeformat="%H:%M" ctime(TIME) AS c_TIME | xyseries DATETIME ACTIVITIES c_TIME

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...