Visualization from different fields

[kiran007]

Hi,

I wanted to create a Visualization from 3 different fields shown below.

the values are above 100. so, I am unable to get any trend on graph. Kindly help me out from this.

Thanks & Regards,

S.Kiran.

[ITWhisperer · Accepted solution]

Your extraction is replacing ms with spaces which means it will continue to be treated as a string rather than a number. Also, if you extract to the field name you want, you don't have to then rename the field.

| rex field=data.msg "cancelAppointment.\s(?P<CA_Time>\d*)"
| rex field=data.msg "bookAppointment.\s(?P<BA_Time>\d*)"
| rex field=data.msg "appointmentCheckIn.\s(?P<AC_In_Time>\d*)"

[s2_splunk]

I am not sure what visualization you are expecting, but you are missing an X-Axis value (like _time) in your result set for a graph to work. Try

... | table _time AC_IN_time, ....

and it should plot your three values over time and auto-adjust the Y-axis scale to match your values.