Splunk Search

Timechart /chart

swetasoneji
New Member

I'm looking to have line chart, which shows AccountID , Username and duration, how would put this with timechart chart so I can have all 3 columns in line chart which says loading time duration on AccountID. or should try using Pivot

Tags (1)
0 Karma
1 Solution

FrankVl
Ultra Champion

Not 100% sure what you are looking for, perhaps you can share a sample / screenshot of the data you have and explain a bit more how you want to visualize it?

If you want to plot the duration over time for each account, you could try something like this:

| timechart avg(duration) by AccountID

If you want both the AccountID and the Username in the series label, then you would have to glue those together into a new field first and then use that field in the by clause:

| eval UsernameID = Username." - ".AccountID
| timechart avg(duration) by UsernameID

View solution in original post

FrankVl
Ultra Champion

Not 100% sure what you are looking for, perhaps you can share a sample / screenshot of the data you have and explain a bit more how you want to visualize it?

If you want to plot the duration over time for each account, you could try something like this:

| timechart avg(duration) by AccountID

If you want both the AccountID and the Username in the series label, then you would have to glue those together into a new field first and then use that field in the by clause:

| eval UsernameID = Username." - ".AccountID
| timechart avg(duration) by UsernameID

swetasoneji
New Member

As above showing avg of duration. I'm looking for how much duration each AccountID taking to launch with their Username. It should show actual duration instead avg.

0 Karma

swetasoneji
New Member

Thanks, above can be useful later however I'm trying to achieve, how long each account is taking to load. so avg(duration) won't be ideal.
So Line chart/column chart should show AccountID, Username and Duration.

0 Karma

FrankVl
Ultra Champion

As I mentioned, I didn't completely understand what you are looking for, so just took a stab at it 🙂

I still don't really follow what you want to achieve to be honest. As mentioned: can you share perhaps what the data looks like before you visualize it? And elaborate a bit on what you want the visualization to show (e.g. what should be on X axis, what on Y axis, what should be the series)?

0 Karma

swetasoneji
New Member

Thanks for above, Basically I would like to Put duration on X Axis and Y- AccountID/USername

0 Karma

FrankVl
Ultra Champion

Ok, so no timechart then.

| chart avg(Duration) over AccountID

And then select a horizontal bar chart, to make the duration show on the x-axis.

You need to apply some stats function to the field you are visualizing, you cannot simply put | chart Duration over AccountID. If there is only 1 Duration per AccountID in your data, then avg() will return that Duration, so that should be fine. If there are multiple Durations in your data, then you need to think what would be the best stats function for you to use (min(), max(), latest()...).

0 Karma

swetasoneji
New Member

Can I put _time as third field?
| eval UsernameID = Username." - ".AccountID

Or perhaps, Duration, Time on X axis and Y axis AccountID/USername

0 Karma

FrankVl
Ultra Champion

Sure you can concatenate a time string to that combined field as well. You might have some challenges sorting it in a meaningful way, but just give it a try.

Not sure how you envision putting duration combined with time on the x-axis. I would say you want to keep the duration on its own, otherwise you can't visualize it anymore as numeric values.

But again: I'm a bit lost as to what you actually want to achieve in the end.

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...