Splunk Search

## Plot Values by Time Loves-to-Learn

Hello, im having trouble getting timechart by value to give me any results. I have a data set that has a value for each day, so far 30 days worth of data, each "Elapsed Time" is anywhere from 33 - 40 seconds, showing 00:33:56 etc etc however when i timechart this i dont get any errors but i also dont get any results. i dont want an average or count but the exact value, is this possible?

i've tried |timechart value(elapsed) , | timechart dc(elapsed) | timechart values(elapsed) span=1d | chart values(elapsed) by _time.

any help would be appreciated

Tags (3)
1 Solution Communicator

Hey Lavster,

I've recreated what I think your dataset might look like in Splunk with the search below. Let me know if it isn't correct:
(you can copy paste this directly into Splunk)

``````| gentimes start=6/1/19 end=6/30/19 increment=1d
| eval seconds = random()%7 + 3
| eval milliseconds = random()%60
| eval milliseconds = if(len(milliseconds) = 1, "0".milliseconds, milliseconds)
| eval elapsed = "00:3".seconds.":".milliseconds
| eval _time = starttime
| table _time elapsed
``````

Assuming that it looks correct, you can use this search to convert the time into seconds, which will allow you to plot the values in a chart:

``````...BASE SEARCH...
| table _time elapsed
| rex field=elapsed "(?<minutes>\d{2})\:(?<seconds>\d{2})\:(?<milliseconds>\d+)"
| eval minutes = minutes * 60, milliseconds = milliseconds / 100
| eval elapsed = minutes + seconds + milliseconds
| chart values(elapsed) OVER _time
``````

Let me know if you run into any trouble! Esteemed Legend

When using `timechart`, the field used as the argument to the aggregation function (e.g. `avg()`) must contain only numbers. In your case, it does not, so change that like this:

``````... | eval | convert dur2sec(elapsed) AS elapsed_seconds | timechart avg(elapsed_seconds) span=1d
`````` Communicator

Hey Lavster,

I've recreated what I think your dataset might look like in Splunk with the search below. Let me know if it isn't correct:
(you can copy paste this directly into Splunk)

``````| gentimes start=6/1/19 end=6/30/19 increment=1d
| eval seconds = random()%7 + 3
| eval milliseconds = random()%60
| eval milliseconds = if(len(milliseconds) = 1, "0".milliseconds, milliseconds)
| eval elapsed = "00:3".seconds.":".milliseconds
| eval _time = starttime
| table _time elapsed
``````

Assuming that it looks correct, you can use this search to convert the time into seconds, which will allow you to plot the values in a chart:

``````...BASE SEARCH...
| table _time elapsed
| rex field=elapsed "(?<minutes>\d{2})\:(?<seconds>\d{2})\:(?<milliseconds>\d+)"
| eval minutes = minutes * 60, milliseconds = milliseconds / 100
| eval elapsed = minutes + seconds + milliseconds
| chart values(elapsed) OVER _time
``````

Let me know if you run into any trouble! Loves-to-Learn

Thanks for this, worked a charm  SplunkTrust

can you post your full query and a sample data set Register for .conf21 Now! Go Vegas or Go Virtual!

### How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20. Learn More or Register Now >

Get Updates on the Splunk Community!