Hello,
I am creating searches/charts for multiple events in a single log file. For most of events, the default time field is what I want to graph the timechart against. However, for a specific case, the actual time I want to graph against is represented in milliseconds in a field "time". I want to be able to chart this as my x-axis, displayed properly as a date would be, but I have no idea how this can be done.
Apologies if this is a simple/obvious answer, but I haven't found anything in the chart/timechart documentation pages.
Thank you.
You could try:
... | eval _time=strptime("%s%3N",time) | chart max(duration) by _time
Hmm, I couldn't get strptime to work properly to format my milliseconds format, which actually should have been strptime(time, "%3N") or strptime(time, "%Q").
However, using eval _time=... gave me an idea to reformat the time being logged in seconds (the format of _time for all log entries) and simply use eval _time=time, which seems to have worked perfectly.
You can do this via xyseries:
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Xyseries
There are other methods to get the type of chart you want, but this is the first that comes to mind.
Gerald has the right answer... I thought you wanted to leverage a field called time to graph as one of the axis. You are simply asking to rework the time field and how it is displayed.
Sorry, I think I was being a little roundabout in my description.
I'm able to use the field 'time' in the x-axis of chart. My issue I'm trying to resolve is that the time displays in milliseconds, and I want it converted to a readable date/time format, if this is possible.
My simple chart definition is as follows: chart max(duration) over time by host
I'm not too sure how an xyseries would improve upon this situation.