Splunk Search

making a chart

harsh1734
New Member

hi,
by running this query in search field
index="New" "Phase * ended" | table phaseinformation , phase_ended , datetime | rename datetime as DATE , phaseinformation as Phase_Info , phase_ended as Phase_End_Time | sort Phase_End_Time by desc

i got the following output

Phase_info Phase_End_Time DATE

phase 1 ended 1200 secs jul 16 12:04:44
phase 0 ended 1000 secs jul 16 11:02:48

now i can make chart of this by simply clicking on reports..but i am not able to get clear representation of phase_info on x axis and phase_end_time on y axis....
so need to make a clear graph..

Tags (1)
0 Karma

zeroactive
Path Finder

Without a larger data set to look at, and without more details about what you want, it's hard to provide direction. You could do a chart that provides the SUM or AVG (average) Phase_End_Time for each Phase_Info value, but just plotting the End Time values for the Phase_Info values isn't going to provide you any value over a table of the results.

0 Karma

linu1988
Champion

You can't do a chart to show that the event came at that time. Some numerical value is needed to plot a graph , e.g. time per phase_info. Thanks

0 Karma

kml_uvce
Builder

can you explain more...

kamal singh bisht
0 Karma
Get Updates on the Splunk Community!

New Year. New Skills. New Course Releases from Splunk Education

A new year often inspires reflection—and reinvention. Whether your goals include strengthening your security ...

Splunk and TLS: It doesn't have to be too hard

Overview Creating a TLS cert for Splunk usage is pretty much standard openssl.  To make life better, use an ...

Faster Insights with AI, Streamlined Cloud-Native Operations, and More New Lantern ...

Splunk Lantern is a Splunk customer success center that provides practical guidance from Splunk experts on key ...