Splunk Search

How to chart elapsed time performance data from dbquery?

danoconnl
Explorer

I've got a db query that returns an activity name and then the elapsed time of the activity that I would like to chart
date returned is in the following format

Activity timing
a 0:0:33 (hh:m:ss)
b 0:0:54
c 0:1:23
d 0:0:2

but when I give the query to the chart, it only puts the activities on the x axis.
I figure I need to tell the chart that the timing part of the data set is a timespan, I just don't know how to

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Try this:

base search involving dbquery | rex field=timing "(?<h>\d+):(?<m>\d+):(?<s>\d+)" | eval duration = s + 60 * (m + 60 * h) | chart avg(duration) by Activity

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Try this:

base search involving dbquery | rex field=timing "(?<h>\d+):(?<m>\d+):(?<s>\d+)" | eval duration = s + 60 * (m + 60 * h) | chart avg(duration) by Activity
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...