plotting date versus time chart

[usha_nittala]

Hi ,
I have a requirement to present a report to show three jobs and what time they start every day.

Eg:

                abc           xyz           lmn
05/10/14        21:30         21:30         21:40
05/11/14        21:35         21:45         21:40
05/12/14        21:30         22:00         21:50

All these three jobs run everyday so I want to plot time when they started as the time might differ for each job everyday.

[harshavrath]

Hi,

The output is in EPOCh(Unix)Time you can convert it by using |fieldformat NEW_Field=strftime(date/Time_field."%d-%m-%Y %H: %M: %S")

[somesoni2]

For visualization you need numeric data for y axis, here the time is string.

[usha_nittala]

I tried this way and got the chart:
| inputcsv mytest.csv| search JOB_NAME="jobstart1" | eval actual=strftime(strptime(ACT_TIME,"%H.%M"),"%H:%M") | chart first(actual) over JOB_DATE by JOB_NAME
and got output like this:
JOB_DATE jobstart1

03/18/2014 21:35

03/19/2014 21:30

03/20/2014 21:45

when I am trying to see the visualization in splunk using line chart.Its not showing anything.. It should show three seperate line as date is on x -axis and time is on y-axis.

Where am I going wrong?

[usha_nittala]

Thanks for the answer.

I have already tried something like this:

| inputcsv mytest.csv | search JOB_NAME="jobstart1" | eval actual=round(strptime(ACT_TIME,"%H.%M"),0) | chart last(actual) over JOB_DATE by JOB_NAME

Its giving me output in this format:

JOB_DATE jobstart1

03/18/2014 1400031300

03/19/2014 1400031900

03/20/2014 1400031600

This giving me time in wierd format.1400031300

How to convert this time to readable format i.e 1400031300 should be 21:35

Thanks,
Usha

[somesoni2]

If you have fields like _time (job run date time) and job_name, then try this:

you base search giving _time, job_name | eval Date=strftime(_time,"%d/%m/%y") | eval Time=strftime(_time,"%H:%M") | chart first(Time) over Date by job_name