Use a field as time in a chart for a specific search?

[mattdavid]

Hello,

I am creating searches/charts for multiple events in a single log file. For most of events, the default time field is what I want to graph the timechart against. However, for a specific case, the actual time I want to graph against is represented in milliseconds in a field "time". I want to be able to chart this as my x-axis, displayed properly as a date would be, but I have no idea how this can be done.

Apologies if this is a simple/obvious answer, but I haven't found anything in the chart/timechart documentation pages.

Thank you.

[gkanapathy]

You could try:

... | eval _time=strptime("%s%3N",time) | chart max(duration) by _time

[mattdavid]

Hmm, I couldn't get strptime to work properly to format my milliseconds format, which actually should have been strptime(time, "%3N") or strptime(time, "%Q").

However, using eval _time=... gave me an idea to reformat the time being logged in seconds (the format of _time for all log entries) and simply use eval _time=time, which seems to have worked perfectly.

[Simeon]

You can do this via xyseries:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Xyseries

There are other methods to get the type of chart you want, but this is the first that comes to mind.

[Simeon]

Gerald has the right answer... I thought you wanted to leverage a field called time to graph as one of the axis. You are simply asking to rework the time field and how it is displayed.

[mattdavid]

Sorry, I think I was being a little roundabout in my description.

I'm able to use the field 'time' in the x-axis of chart. My issue I'm trying to resolve is that the time displays in milliseconds, and I want it converted to a readable date/time format, if this is possible.

My simple chart definition is as follows: chart max(duration) over time by host

I'm not too sure how an xyseries would improve upon this situation.