Splunk Search

Need help in creating timechart query

jcvytla
New Member

I have hourly data for 30 days on execution of jobs. I wanted to create a timechart based on elapsed time. could you please help me through. my query:

| inputlookup xxxx.csv |eval in_epoch = strptime(time, "%m/%d/%Y %H:%M") | timechart span=1d as ElapsedTime

Could you please help?

Tags (1)
0 Karma

mayurr98
Super Champion

I think you should try something like this

| inputlookup xxxx.csv |eval _time=strptime(time, "%m/%d/%Y %H:%M") | timechart span=1d count

OR

| inputlookup xxxx.csv |eval _time=time | bin _time span=1d | stats count by _time

let me know if this helps!

0 Karma

jcvytla
New Member

HI Mayur,

Thanks for your response. But, both the solution are not working. Data is not being populated in the first place.

Thanks

0 Karma

splunker12er
Motivator

try this,

 | inputlookup xxxx.csv |eval in_epoch = strptime(time, "%m/%d/%Y %H:%M")  | bucket in_epoch span=1d| stats count values(your_field) as your_field by in_epoch |convert ctime(in_epoch)
0 Karma

jcvytla
New Member

Hi @splunker12er,

Thanks for your response. I don't get any error, but is not being populated

0 Karma

splunker12er
Motivator

try this,

| inputlookup xxxx.csv |eval in_epoch = strptime(time, "%m/%d/%Y %H:%M")  | bucket in_epoch span=1d| stats count values(your_field) as your_field by in_epoch |convert ctime(in_epoch)
0 Karma

adonio
Ultra Champion

try this:
| inputlookup xxxx.csv |eval _time = strptime(time, "%m/%d/%Y %H:%M") | timechart span=1d as ElapsedTime

0 Karma

jcvytla
New Member

Hi @adonio,

Thanks for your response.I'm getting this error while running the your solution:

"Error in 'timechart' command: The specifier 'as' is invalid. It must be in form (). For example: max(size)."

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...