How can i plot value of three fields on timechart
ProcessName duration(Sec) _time
SaveAllData 1.2 2013-09-24T04:57:20.325+0530
SaveAllData 0.02 2013-09-24T02:57:17.680+0530
working_Days_test 0.05 2013-09-23T22:16:57.994+0530
CreateProductsCSV 0.05 2013-09-23T12:08:27.489+0530
i want to see a timechart which shows which process took how many seconds and at what time
Yes, that is expected - that's why you should use timechart, because it automatically keeps the amount of datapoints down for you. But you said you didn't want that, so this is the issue you'll be running into instead.
Well, that would be how you would achieve what you want. I just verified this on my own installation here. If that truly is your search, please note that field names are case sensitive, so "Processname" is not the same as "processname".
Hey thanks i wasn't knowing about this command but its not showing anything on chart i can see only names of the processes
this is my search
index=tm_idx host="server" "finished executing normally" | rex field=_raw "(?i)Process\s(\"|\"})(?
basically i want to show number of process running on ther server with the time it took to complete
Did you try it?
Depending upon your data, that may show exactly what you're after; you'll only get max (and not each and every duration) if there are multiple durations in the same second.