Splunk Search

How to plot a stacked column chart with TIME taken from data in a CSV file as the y-axis ?

I have a csv file as shown below.

1Jan      Activity1 0:02:00
1Jan    Activity2   2:45:00
1Jan    Activity3   0:00:05
1Jan    Activity4   0:00:01
1Jan    Activity5   3:00:00
1Jan    Activity6   1:15:00
1Jan    Activity7   0:30:00
1Jan    Activity8   0:00:30
1Jan    Activity9   0:30:00
1Jan    Activity10   0:10:00
1Jan    Activity11   0:50:00
1Jan    Activity12   0:03:00
2Jan    Activity1   0:01:18
2Jan    Activity2   1:23:08
2Jan    Activity3   0:00:05
2Jan    Activity4   0:00:00
2Jan    Activity5   2:49:53
2Jan    Activity6   1:02:41
2Jan    Activity7   0:29:33
2Jan    Activity8   0:00:14
2Jan    Activity9   1:09:34
2Jan    Activity10   0:02:47
2Jan    Activity11   0:46:03
2Jan    Activity12   0:02:01

I have converted the TIME column to Splunk's TIMEFORMAT, Then I was trying to plot a stacked chart with xyseries command like:

But its doesnt plots the graph as Splunk is not able to identify the TIME, and plot it.
This is how I want to display the result as following picture:
alt text

The Y axis labels should be with respect to time format.
Please Help..

Tags (4)
0 Karma

Path Finder

... |convert timeformat="%H:%M" ctime(TIME) AS cTIME | xyseries DATETIME ACTIVITIES cTIME

0 Karma