Splunk Search

Need help in creating timechart query

jcvytla
New Member

I have hourly data for 30 days on execution of jobs. I wanted to create a timechart based on elapsed time. could you please help me through. my query:

| inputlookup xxxx.csv |eval in_epoch = strptime(time, "%m/%d/%Y %H:%M") | timechart span=1d as ElapsedTime

Could you please help?

Tags (1)
0 Karma

mayurr98
Super Champion

I think you should try something like this

| inputlookup xxxx.csv |eval _time=strptime(time, "%m/%d/%Y %H:%M") | timechart span=1d count

OR

| inputlookup xxxx.csv |eval _time=time | bin _time span=1d | stats count by _time

let me know if this helps!

0 Karma

jcvytla
New Member

HI Mayur,

Thanks for your response. But, both the solution are not working. Data is not being populated in the first place.

Thanks

0 Karma

splunker12er
Motivator

try this,

 | inputlookup xxxx.csv |eval in_epoch = strptime(time, "%m/%d/%Y %H:%M")  | bucket in_epoch span=1d| stats count values(your_field) as your_field by in_epoch |convert ctime(in_epoch)
0 Karma

jcvytla
New Member

Hi @splunker12er,

Thanks for your response. I don't get any error, but is not being populated

0 Karma

splunker12er
Motivator

try this,

| inputlookup xxxx.csv |eval in_epoch = strptime(time, "%m/%d/%Y %H:%M")  | bucket in_epoch span=1d| stats count values(your_field) as your_field by in_epoch |convert ctime(in_epoch)
0 Karma

adonio
Ultra Champion

try this:
| inputlookup xxxx.csv |eval _time = strptime(time, "%m/%d/%Y %H:%M") | timechart span=1d as ElapsedTime

0 Karma

jcvytla
New Member

Hi @adonio,

Thanks for your response.I'm getting this error while running the your solution:

"Error in 'timechart' command: The specifier 'as' is invalid. It must be in form (). For example: max(size)."

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...