Splunk Search

How to use String fields in chart??

Rajkumarkbm
Engager

I want to use the string Fields in the chart. Please help me on this.

EX:
Date Duration Volume
01-02-2018 02:20 10000
02-02-2018 04:10 15000
.
.
28-02-2-18 03:02 15323
for the above date should be in x axis and the other 2 in Y axis.

Thank You.
Raj

Tags (2)
0 Karma

deepashri_123
Motivator

Hey@Rajkumarkbm ,

Try using timechart
index=* | timechart span=1d sum(Volume) AS Volume sum(Duration) AS Duration.

Let me know if this helps!!

0 Karma

niketn
Legend

@Rajkumarkbm, refer to Timeline Custom Visualization from Splunk.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...