Splunk Search

timechart question

xipander
New Member

I'm trying to graph a custom long that gives the round trip time of a web service request. I've got sourcetype="wsping.log" |stats first(RoundTrip) by _time gives me the table with the correct values, but when I try to chart it doesn't show up. I think the problem is that my roundtrip value looks like RoundTrip=00:00:00:12 so it's not showing up in the chart? it logs every second so essentially i need every second/log entry on the x axis and the roundtrip value on the y axis in a line graph so we can see spikes. thanks.

Tags (3)
0 Karma

RicoSuave
Builder

Try this:
| eval roundtriptime=strptime(RoundTrip,"%S") | chart avg(roundtriptime) over _time

If that doesn't work try strftime instead

0 Karma

RicoSuave
Builder

Sweet. Glad i could help. Can you accept my answer? 🙂

0 Karma

xipander
New Member

This got me going in the right direction. I had to specify the full strptime values.

RoundTrip | eval roundtriptime=strptime(RoundTrip,"%H:%M:%S:%s") | chart avg(roundtriptime) over _time

0 Karma

RicoSuave
Builder

Are you extracting a field for the actual webservice? I would graph the roundtrip time by webservice over time. Try:

<yoursearch> | timechart avg(RoundTrip) by <yourWebServiceField>
0 Karma

xipander
New Member

Date 09/02/2011 Begin = 08:55:09:13, End = 08:55:09:26, RoundTrip = 00:00:00:12

That's all I have in the log entries, the tables and search results show up right, just the line charts don't. I think it has to do with the way the "times" are formatted it's not graphing them properly?

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...