Splunk Search

Timechart breaking up

reverse
Contributor

Expected result

Date    xxx
2019-05-05T00:00:00.000-0400    119394
2019-05-12T00:00:00.000-0400    705593
2019-05-19T00:00:00.000-0400    724051
2019-05-26T00:00:00.000-0400    622243
2019-06-02T00:00:00.000-0400    923656
2019-06-09T00:00:00.000-0400    1040106
2019-06-16T00:00:00.000-0400    1117687
2019-06-23T00:00:00.000-0400    1331860
2019-06-30T00:00:00.000-0400    779990
2019-07-07T00:00:00.000-0400    838488
2019-07-14T00:00:00.000-0400    884224

Actual result

Date    xxx
    2019-05-05T00:00:00.000-0400    119394
    2019-05-12T00:00:00.000-0400    705593
    2019-05-19T00:00:00.000-0400    724051
    2019-05-26T00:00:00.000-0400    622243
    2019-06-02T00:00:00.000-0400    923656
    2019-06-09T00:00:00.000-0400    1040106
    2019-06-16T00:00:00.000-0400    1117687
    2019-06-23T00:00:00.000-0400    1331860
    2019-06-30T00:00:00.000-0400    779990
    2019-07-07T00:00:00.000-0400    838488
    2019-07-11T00:00:00.000-0400    884224

please see the last rows.

query

.....
| table Date , xxx
| eval formattedDate=strptime(Date, "%Y-%m-%d") 
| where formattedDate > relative_time(now(), "-10w@w") 
| eval _time=formattedDate |  bin  _time  AS TIME span=7d@w2 | convert ctime(TIME)  
| stats avg(xxx) by TIME
Tags (1)
0 Karma

mattymo
Splunk Employee
Splunk Employee

So is the issue the date field values in the second set of results?

We might want to avoid the table command, where you drop the _time field.

What sourcetype are you using and how is date/time extraction being handled? got a props.conf by any chance?

Sounds like events have been on-boarded where the date field should have been used for the _time value?

- MattyMo
0 Karma

reverse
Contributor

sourcetype = data from CSV ..2 columns as shown above ..

0 Karma

mattymo
Splunk Employee
Splunk Employee

so are you literally using the sourcetype called "csv"?

in the props.conf we can ensure the _time values are extracted and formatted?

can you share the source csv, or just confirm how it looks when you ingest it?

I'll ingest your expected table as a csv and share the configs. You just want to depict the xxx value over time correct? for the last 10 weeks?

I think we can simplify the spl a bit.

- MattyMo
0 Karma

reverse
Contributor

i am doing |inputcsv to load data into splunk.

0 Karma

mattymo
Splunk Employee
Splunk Employee

so you have a search that |outputcsv then you load that with |inputcsv ?

- MattyMo
0 Karma

reverse
Contributor

initially yes .. to build that CSV ... WHERE i am exporting 2 columns .. date and xx

0 Karma

mattymo
Splunk Employee
Splunk Employee

sweet, i will play and report back

- MattyMo
0 Karma

reverse
Contributor

tried timechart, chart .. played with span=7d@w2.. same result

0 Karma

reverse
Contributor

@Vijeta @jnudell_2 -please guide

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...