hi,
hi,
How can i plot value of three fields on timechart
ProcessName duration(Sec) _time
SaveAllData 1.2 2013-09-24T04:57:20.325+0530
SaveAllData 0.02 2013-09-24T02:57:17.680+0530
working_Days_test 0.05 2013-09-23T22:16:57.994+0530
CreateProductsCSV 0.05 2013-09-23T12:08:27.489+0530
i want to see a timechart which shows which process took how many seconds and at what time
Thanks
If you just want plot values and don't care about limiting datapoints etc, you could just do
... | xyseries _time ProcessName duration
Yes, that is expected - that's why you should use timechart, because it automatically keeps the amount of datapoints down for you. But you said you didn't want that, so this is the issue you'll be running into instead.
xyseries creates problem when i increase my time range as its plotting each n every day
my search is running properly its copy paste mistake..i can see the names of the processes as legend but no chart is displayed
Well, that would be how you would achieve what you want. I just verified this on my own installation here. If that truly is your search, please note that field names are case sensitive, so "Processname" is not the same as "processname".
Hey thanks i wasn't knowing about this command but its not showing anything on chart i can see only names of the processes
this is my search
index=tm_idx host="server" "finished executing normally" | rex field=_raw "(?i)Process\s(\"|\"})(?
basically i want to show number of process running on ther server with the time it took to complete
Try the below alternative (produces similar results as timechart)
index=myindex sourcetype=processdata |chart max(duration) as duration over _time by ProcessName
Did you try it?
Depending upon your data, that may show exactly what you're after; you'll only get max (and not each and every duration) if there are multiple durations in the same second.
hi i dont want max of duration i want to plot each and every duration