I have csv file uploaded on to splunk.Here is the sample entries
Intime Outtime 8:33 17:39 8:38 17:40 8:33 19:28 8:32 17:37
Here i created calculated field which gives the difference between Intime and outtime.
Expected output is
Intime Outtime durationHrs 8:33 17:39 9.100 8:38 17:40 9.033 8:33 19:28 10.19 8:32 17:37 9.083
The query is given below :
host="abc" | convert mstime(Outtime) AS otime | convert mstime(Intime) AS itime |eval durationHrs=(otime - itime)/60 | Timechart count by durationHrs
Here i want to generate a chart in such a way that my Y-axis should be durationHrs and X-axis should be time but in the above query,in Y-axis i'm getting count not the durationHrs values.
How this can be done? Do we need to use different function other than count in a timechart,if yes what needs to be used/done?
time on the X-axis by default. Your problem is that you count the numbers of events that contain a field named durationHrs, instead of displaying the values of this field.
To achieve what you want, change your search to something like this:
host="abc" | convert mstime(Outtime) AS otime, mstime(Intime) AS itime |eval durationHrs=(otime - itime)/60 | timechart values(durationHrs) AS myDuration
hope this helps.....