Splunk Search

Show time in minutes on the Y axis

yrajabi1
Engager

Hello, I have a set of data that I have shared below that I am charting with a line against the source. I cannot get the time(in minutes) to be on the Y axis. Any advice would be appreciated.

index=advantage sourcetype=searchtimes source="build." | transaction startswith="About to start Index Build" endswith="Time taken for index build"| eval timedur= (duration)/60 | convert timeformat=%M:%S ctime(timedur) | chart first(timedur) by source

1 C:\SPLUNK\build.log.20130217 02:01
2 C:\SPLUNK\build.log.20130218 02:04
3 C:\SPLUNK\build.log.20130219 02:05
4 C:\SPLUNK\build.log.20130220 02:08
5 C:\SPLUNK\build.log.20130221 02:12
6 C:\SPLUNK\build.log.20130222 02:09
7 C:\SPLUNK\build.log.20130223 02:15
8 C:\SPLUNK\build.log.20130224 02:10
9 C:\SPLUNK\build.log.20130225 02:16

In my XML I have this..
P0Y0M0DT0H15M0S
P0Y0M0DT0H0M0S
line
1

Thanks!!

0 Karma

davecroto
Splunk Employee
Splunk Employee

When I run this timechart the graph brakes the "x axis" into minutes.

index=_internal earliest=-1m |timechart span=60s count by group

You are specifying a line chart. If you want to show minutes or time on the y axis, would it make sense to use a column instead of a line?

0 Karma

davecroto
Splunk Employee
Splunk Employee

Maybe this example makes more sense. In a column of course

index=_internal earliest=-1m |eval desired_time=strftime(_time, "%I:%M:%S %p") |chart count by desired_time

0 Karma
Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...