Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Splunk Search
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How to plot a timechart from summary index?
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
splbsm
Explorer
03-07-2019
05:02 AM
Hi, I have a summery index with events like this :-
3/06/2019 00:00:00 +0000, search_name=ABCD , search_now=1551916800.000, info_min_time=1551830400.000, info_max_time=1551916800.000, info_search_time=1551916803.490, SourceType="up2date-too_small", date="2019-03-06", info_max_time="1551916800.000", info_min_time="1551830400.000", info_search_time="1551916803.490", info_sid="scheduler_612483161search_RMD5b9c004924d61345e_at_1551916800_2619_CB367A2F-91DF-4379-90F8-63AC41173EAB", sum(b)=960, ABCD, search_name
Now I want to use the date from this event and plot a timechart by sourcetype. Can anyone help me please?
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
nickhills
Ultra Champion
03-07-2019
06:15 AM
Give this a go:
[your search]|rename SourceType as original_sourcetype| eval _time=strptime(date, "%Y-%m-%d")|timechart count by original_sourcetype
This assumes you want to timechart them by the date from the summary index
Just as an aside - the rename is probably not necessary, but it helps clarify when you comeback to it in 6months and have forgotten what you did.
If my comment helps, please give it a thumbs up!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
nickhills
Ultra Champion
03-07-2019
06:15 AM
Give this a go:
[your search]|rename SourceType as original_sourcetype| eval _time=strptime(date, "%Y-%m-%d")|timechart count by original_sourcetype
This assumes you want to timechart them by the date from the summary index
Just as an aside - the rename is probably not necessary, but it helps clarify when you comeback to it in 6months and have forgotten what you did.
If my comment helps, please give it a thumbs up!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
splbsm
Explorer
03-07-2019
07:02 AM
Thank you very much.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
nickhills
Ultra Champion
03-07-2019
07:21 AM
Your welcome!
I updated the title of this question to help others who may be searching in the future!
If my comment helps, please give it a thumbs up!
Get Updates on the Splunk Community!
Enterprise Security Content Update (ESCU) | New Releases
In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
(This is the first of a series of 2 blogs).
Splunk Enterprise Security is a fantastic tool that offers robust ...
Index This | What are the 12 Days of Splunk-mas?
December 2024 Edition
Hayyy Splunk Education Enthusiasts and the Eternally Curious!
We’re back with another ...
