Splunk Search

Scatter Plot for time x-axis and numbered Y axis

howardroark
Explorer

I am looking to plot scatter plot to show all the data points in a particular time. Some how I am not able to get around it.
I tried using this:
..|eval time = _time | table time time_taken
This gives me the scatter plot with all the data points but the time displays in epoch.

Can i get a work around for this or a new method to get time in correct timestamp format.

Thanks.

murakoshi
Engager

Scatter Chart is suitable for numerical expression on the X axis, not suitable for expressing rich time.
Therefore, I recommend using a Line Chart to try it.

1. Insert Null under each row of your table.

Example:

<base search>
| stats values(Y_Value) as Y_Value by _time,Status
| eval {Status}=Y_Value 
| append 
    [ search <base search> 
    | stats values(Y_Value) as Y_Value by _time,Status
    | eval Y_Value =null
        ] 
| sort 0 _time,Status
| fields - Y_Value ,Status

2. Set the graph as follows.

Graph: Line Chart
Setting: format> General> Null Values> select [Gaps]

alt text

scombs
Explorer

Thanks, it worked great. Note I had to use an Area Chart to plot dots rather than lines. (Splunk ver 7.3.3)

0 Karma

Richfez
SplunkTrust
SplunkTrust

Nice workaround, @murakoshi.

For what it's worth, there is now an Enhancement Request (SPL-152883) in place to make Scatterchart work with time. For some reason, they decided this behavior wasn't actually a bug but still needed fixing some day.

bowesmana
SplunkTrust
SplunkTrust

Kudos @murakoshi

Nice technique. I was just trying to work out how to do this and came across this post. Thanks

0 Karma

MattZerfas
Communicator

This won't work for long duration's of time but it might get what you need if you are looking at a few hours or less.

 index=_internal 
| timechart count 
| eval time=_time 
|table  time count 
| fieldformat time=strftime(time, "%Y%m%d%H%M%S") 

alt text

howardroark
Explorer

I am looking at data at a span of months, even years.

0 Karma

MattZerfas
Communicator

How granular or you wanting the data to show?

0 Karma

howardroark
Explorer

The data is granular upto seconds.

0 Karma

howardroark
Explorer

its basically the raw data i want to show. 'as is'

0 Karma

dijikul
Communicator

Did you ever solve this with Splunk? I want to do something similar - plot a single pixel for each event, with X as Time...

0 Karma

Richfez
SplunkTrust
SplunkTrust

I have not really found a great way to handle this. Splunk's sort of backed everyone into a corner by treating _time specially for a few of these chart types, so about the best thing I know to do is ask your rep if you can lend your own voice to fixing Enhancement Request SPL-152883 to make Scatterchart work with time.

Of course they're redoing the ER system, so let's see if this bridges the gap from old to new system.

Otherwise, what doesn't work correctly with the workaround MattZerfas posted of just recreating your time field as a string and making it pretty?

0 Karma

MattZerfas
Communicator

You are probably better off using a 3rd part viz to display that data then. Splunk native viz isn't the greatest at displaying large amounts of data points. Maybe look at importing a https://d3js.org/ chart?

0 Karma

Richfez
SplunkTrust
SplunkTrust

To make the display of the field be in something human readable, use fieldformat.

..
| eval time = _time 
| fieldformat time = strftime(time, "%H:%M:%S")
| table time time_taken

Of course, that just does Hours:Minutes:Seconds. If you need full dates you can use "%y-%m-%d %H:%M%:%S". Or day plus time could be "%d %H:%M%:%S" or .... well, I think you get the idea.

Let us know how it goes!

Happy Splunking,
Rich

0 Karma

howardroark
Explorer

This does not give me a scatter plot

0 Karma

Richfez
SplunkTrust
SplunkTrust

Could you elaborate on what it doesn't do? You wrote in the original post

..|eval time = _time | table time
time_taken This gives me the scatter
plot with all the data points but the
time displays in epoch.

Which implied you had a scatter plot, but just didn't have the format of the time sorted out.

What else is wrong?

0 Karma

howardroark
Explorer

Yes I have the scatterplot with my code. But after using your code the scatter plot chart has all the values at 0. and the x axis is not time any more it is some number 20,30,40,50

0 Karma

howardroark
Explorer

My code is nothing but the same code given in the question |eval time = _time | table time time_taken.. this when switched to scatter plot chart gives you all the individual data points. But the x axos changes to epoch

0 Karma

Richfez
SplunkTrust
SplunkTrust

You are right. Scatter charts don't seem to behave the same...

Usually you can fieldformat that stuff - it doesn't affect that the value is still in epoch, but it change the display of that field to be more human friendly.

In this case, the scatter chart doesn't work.

We're looking into it on Slack right now, digging around. Your question has been brought to the attention of others and we'll see if we can figure out if this is a bug or if there's a workaround.

0 Karma

Richfez
SplunkTrust
SplunkTrust

A ticket has been opened. I think I may have now convinced support there's a real problem here. I will post back what I find.

howardroark
Explorer

Thanks rich! This is really appreciated!

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...