Splunk Search

create chart monthly/weekly

kml_uvce
Builder

I have a requirement in that i have events for diiffrent dates

28,489,BLR 3BC019-Web18,172.22.16.21, Mani Sundaram,72.246.2.183,00259004993e,20,2012-02-16 10:07:40,00:01:01,In,H.323,None,1600,1600,H.264,G.711Ulaw,1280x720,H.264,G.711Alaw,1280x720,No,No,None,Normal,0.000,0.000,0,1,0.000,12.000,0,19,0.000,0.000,0,1,1.000,29.000,1,30,0.000,0.000,0,0,0.000,0.000,0,0,vtc-3bc019-Web18.bangalore

in this event the date is field end_date '2012-02-16' and duration is field duration '20' sec
so there are many diffrent dates (end_date) for a month, so this will be in many months
I want a search that shows me every month duration (sum of duration for a month and shows for month not for date)
also search for weekly duration.

Tags (2)
0 Karma
1 Solution

kml_uvce
Builder

i tried
|chart sum(duration) over end_date

and the output is
end_date sum(duration)
1 2010-06-03 13:35:56 11
2 2010-07-09 10:01:59 3600
3 2010-07-27 16:08:38 3963
4 2010-07-27 17:08:35 280
5 2010-07-28 09:57:09 1550
6 2010-07-28 14:05:03 9006
7 2010-07-28 15:32:01 3375
8 2010-07-28 19:06:40 11171
9 2010-08-02 15:26:14 1581
10 2010-08-03 12:32:41 1963

I want output like this
month sum
june ....
July ...
etc

If output comes in graph/chart then it will be good

View solution in original post

kml_uvce
Builder

i tried
|chart sum(duration) over end_date

and the output is
end_date sum(duration)
1 2010-06-03 13:35:56 11
2 2010-07-09 10:01:59 3600
3 2010-07-27 16:08:38 3963
4 2010-07-27 17:08:35 280
5 2010-07-28 09:57:09 1550
6 2010-07-28 14:05:03 9006
7 2010-07-28 15:32:01 3375
8 2010-07-28 19:06:40 11171
9 2010-08-02 15:26:14 1581
10 2010-08-03 12:32:41 1963

I want output like this
month sum
june ....
July ...
etc

If output comes in graph/chart then it will be good

Ayn
Legend

What have you tried so far? What is working or not working?

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...