Splunk Search

chart only display when event exist at day / day hour

Explorer

Hi

how to display in chart only the days (or day & hour) when a „event“ (in my case speedtest results) is/are available.

i do not need „count“, „avg“ …
in the community i found:
| timechart fixedrange=false count

but, cause i dont need/use „count by XY“ this is useless for me.

and, it can be to have more than just one (1) result per day.

_time           field_speedUp   field_speed_Down
2019/11/13 14:35:09     800     400
2019/11/13 14:37:28       300       200

thanks for helping 😉

Tags (2)
0 Karma
1 Solution

SplunkTrust
SplunkTrust
| makeresults
| eval raw="time            field_speedUp    field_speed_Down
2019/11/13 14:35:09      800        400
2019/11/13 14:37:28       300        200
2019/11/13 14:39:28       400        200"
| eval _raw=replace(raw,"  +",",")
| multikv forceheader=1
| eval _time=strptime(time,"%Y/%m/%d %H:%M:%S")
`comment("this is sample data")`
| table _time field_speedUp field_speed_Down

Hi, check Visualization and Line Chart
To separate _time, use bin command.

View solution in original post

Esteemed Legend

Like this:

... | timechart fixedrange=false first(speedup) AS speedup first(speeddown) AS speeddown
0 Karma

Explorer

thank you woodcock

0 Karma

SplunkTrust
SplunkTrust
| makeresults
| eval raw="time            field_speedUp    field_speed_Down
2019/11/13 14:35:09      800        400
2019/11/13 14:37:28       300        200
2019/11/13 14:39:28       400        200"
| eval _raw=replace(raw,"  +",",")
| multikv forceheader=1
| eval _time=strptime(time,"%Y/%m/%d %H:%M:%S")
`comment("this is sample data")`
| table _time field_speedUp field_speed_Down

Hi, check Visualization and Line Chart
To separate _time, use bin command.

View solution in original post

Explorer

Thank you. That's exactly what I was looking for.
- michael

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!