How to search a Line Graph to show monthly trends

[Yy4pb]

Hi,

I am new to Splunk and struggling to create Line Graphs. I have a query which display a count for the month:

index="app" earliest=1640995200 latest=1643673600 | stats count AS January | appendcols [search index="app" earliest=1643673600 latest=1646092800 | stats count AS February]

This is correctly presenting the information as I would expect it:

I am almost certain my search is not correct, as when I attempt to plot this on a Line Graph the axis are not correct. I would like the Total number on the Y axis, and the months along the X axis. 

Would appreciate any guidance. Thank you! 

[gcusello · Accepted solution]

Hi @Yy4pb,

did you tried something like this:

index="app" earliest=1640995200 latest=1646092800 
| eval date_mon=strftime(_time,"%B")
| stats count BY date_mon

Ciao.

Giuseppe

[Yy4pb]

That looks good and works, but how would I compare results with the previous month on the linegraph as well? Thanks

[gcusello]

Hi @Yy4pb,

instead dedining earliest and latest, you could define time borders using the Time Picker, then the eval command will define the month to use in the line graph.

If you want a delta from the values of each month, you could use the command "delta":

index="app" earliest=1640995200 latest=1646092800 
| eval date_mon=strftime(_time,"%B")
| stats count BY date_mon
| delta count

Ciao.

Giuseppe