Splunk Search

Timechart graph with difference in values ​​over the last 60 minutes

leandromatperei
Path Finder

I have the result below in a table, but for some technical reasons I need to check these values ​​in a bar chart, but as the field is a string containing date and time I am not able to perform the conversion

 

index=teste "EnviaSMS" | table _time, enviaSMS, GravaDB, VerificaTotal 
| rename VerificaTotalSec As "Verifica - TotalEmSegundos" | sort -_time

 

 

Application Log:

 

2020-07-21T12:49:40.168 Dbg 09900 [000c02f527958102] [Tempos] - EnviaSMS:0h0m0s0ms - GravaDB:0h0m0s16ms - VerificaTotal:0h0m0s172ms

2020-07-21T12:49:40.136 Dbg 09900 [000c02f527957636] [Tempos] - EnviaSMS:0h0m0s0ms - GravaDB:0h0m0s0ms - VerificaTotal:0h0m0s155ms

2020-07-21T12:49:40.136 Dbg 09900 [000c02f527957636] [Tempos] - EnviaSMS:0h0m0s0ms - GravaDB:0h0m0s0ms - VerificaTotal:0h0m0s160ms

 

 

How could I calculate the last 60 minutes on a line graph displaying the information in the 03 columns?

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

This should help with the conversion.

| makeresults | eval data="2020-07-21T12:49:40.168 Dbg 09900 [000c02f527958102] [Tempos] - EnviaSMS:0h0m0s0ms - GravaDB:0h0m0s16ms - VerificaTotal:0h0m0s172ms|
2020-07-21T12:49:40.136 Dbg 09900 [000c02f527957636] [Tempos] - EnviaSMS:0h0m0s0ms - GravaDB:0h0m0s0ms - VerificaTotal:0h0m0s155ms|
2020-07-21T12:49:40.136 Dbg 09900 [000c02f527957636] [Tempos] - EnviaSMS:0h0m0s0ms - GravaDB:0h0m0s0ms - VerificaTotal:0h0m0s160ms" | eval data=split(data,"|") | mvexpand data | eval _raw=data
| eval _time=strptime(_raw, "%Y-%m-%dT%H:%M:%S.%3N")
| rex "EnviaSMS:(?<enviaSMS>\w+)"
| rex "GravaDB:(?<GravaDB>\w+)"
| rex "VerificaTotal:(?<VerificaTotal>\w+)"
```Above just defines test data```
| rex field=enviaSMS "(?<hr>\d+)h(?<min>\d+)m(?<sec>\d+)s(?<ms>\d+)"
| eval enviaSMS=exact(hr*3600+min*60+sec+(ms/1000))
| rex field=GravaDB "(?<hr>\d+)h(?<min>\d+)m(?<sec>\d+)s(?<ms>\d+)"
| eval GravaDB=exact(hr*3600+min*60+sec+(ms/1000))
| rex field=VerificaTotal "(?<hr>\d+)h(?<min>\d+)m(?<sec>\d+)s(?<ms>\d+)"
| eval VerificaTotal=exact(hr*3600+min*60+sec+(ms/1000))
| table _time, enviaSMS, GravaDB, VerificaTotal
| rename VerificaTotal As "Verifica - TotalEmSegundos" | sort -_time
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This should help with the conversion.

| makeresults | eval data="2020-07-21T12:49:40.168 Dbg 09900 [000c02f527958102] [Tempos] - EnviaSMS:0h0m0s0ms - GravaDB:0h0m0s16ms - VerificaTotal:0h0m0s172ms|
2020-07-21T12:49:40.136 Dbg 09900 [000c02f527957636] [Tempos] - EnviaSMS:0h0m0s0ms - GravaDB:0h0m0s0ms - VerificaTotal:0h0m0s155ms|
2020-07-21T12:49:40.136 Dbg 09900 [000c02f527957636] [Tempos] - EnviaSMS:0h0m0s0ms - GravaDB:0h0m0s0ms - VerificaTotal:0h0m0s160ms" | eval data=split(data,"|") | mvexpand data | eval _raw=data
| eval _time=strptime(_raw, "%Y-%m-%dT%H:%M:%S.%3N")
| rex "EnviaSMS:(?<enviaSMS>\w+)"
| rex "GravaDB:(?<GravaDB>\w+)"
| rex "VerificaTotal:(?<VerificaTotal>\w+)"
```Above just defines test data```
| rex field=enviaSMS "(?<hr>\d+)h(?<min>\d+)m(?<sec>\d+)s(?<ms>\d+)"
| eval enviaSMS=exact(hr*3600+min*60+sec+(ms/1000))
| rex field=GravaDB "(?<hr>\d+)h(?<min>\d+)m(?<sec>\d+)s(?<ms>\d+)"
| eval GravaDB=exact(hr*3600+min*60+sec+(ms/1000))
| rex field=VerificaTotal "(?<hr>\d+)h(?<min>\d+)m(?<sec>\d+)s(?<ms>\d+)"
| eval VerificaTotal=exact(hr*3600+min*60+sec+(ms/1000))
| table _time, enviaSMS, GravaDB, VerificaTotal
| rename VerificaTotal As "Verifica - TotalEmSegundos" | sort -_time
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...