Splunk Search
Highlighted

Timechart Not working after eval _time

Builder

Hello,

I am using timechart in my query. I want to create timechart based on time specified in file rather than _time (splunk injestion time). when I replace the _time with require time, it's not working. even though format is same for both of them.

Data Coulmns:
alt text

When I replace GC_TIMESTAMP with _time its not working.
alt text

Query:

   |tstats summariesonly=true values(GC.before_gc) as before_gc values(GC.max_gc) as max_gc values(GC.after_gc) as after_gc FROM datamodel=GC_ORG WHERE (nodename=GC host=TALANX_PostGoLive GC.service_name=mxmlc_gc.2017-11-06_17-20-53.log) GROUPBY GC.GC_TIMESTAMP,_time,GC.relative_time span=1s | rename GC.GC_TIMESTAMP as GC_TIMESTAMP | rename GC.relative_time as relative_time | rename GC_TIMESTAMP as _time | timechart fixedrange=false bins=2000 max(before_gc) as total_mem_before_gc,max(after_gc) as total_mem_after_gc, max(max_gc) as max_memory

Am I missing some thing ?
Thanks

0 Karma

Re: Timechart Not working after eval _time

SplunkTrust
SplunkTrust

The _time is a special field who values is in epoch but Splunk displays in human readable form in it's visualizations. Renaming your string formatted timestamp column GCTIMESTAMP as _time will change the value as string, as oppose to epoch, hence it doesn't work. Try like this (using strptime command to convert string GCTIMESTAMP to epoch and assigned to _time field)

  |tstats summariesonly=true values(GC.before_gc) as before_gc values(GC.max_gc) as max_gc values(GC.after_gc) as after_gc FROM datamodel=GC_ORG WHERE (nodename=GC host=TALANX_PostGoLive GC.service_name=mxmlc_gc.2017-11-06_17-20-53.log) GROUPBY GC.GC_TIMESTAMP,_time,GC.relative_time span=1s | rename GC.GC_TIMESTAMP as GC_TIMESTAMP | rename GC.relative_time as relative_time | eval _time=strptime(GC_TIMESTAMP,"%Y-%m-%d %H:%M:%S") | timechart fixedrange=false bins=2000 max(before_gc) as total_mem_before_gc,max(after_gc) as total_mem_after_gc, max(max_gc) as max_memory

View solution in original post