I Have a db query that returns data as below.
Now i want
1. to get a search result where all the rows where rank <11 should appear
2. Once i get the data i want to show a chart of concurrent program execution time over all the weeks each concurrent program in one chart
3. Another charts of the top 10 ConcurrentProgramName on x axis and etime on y axis per week
WEEK rank ConcurrentProgramName ETIME
1-Oct 2 Move Order Pick Slip 86379
1-Oct 3 Planning Manager 86360
4-Sep 4 Report Set 86347
2-Oct 5 Planning Manager 863394
4-Sep 6 Planning Manager 86316
3-Oct 7 Planning Manager 86294
3-Oct 8 Planning Manager 86247
1-Oct 19 Timesheet Data Transfer to EE Form 70084
Please help me get the conditions asap.
|dbquery "select WEEK,rank,ConcurrentProgramName,Etime from conTab"
I just want to point out that trying to command the community to do things for you is rather rude. Splunkbase users do not get paid for contributing, so any help you get is because someone is kind enough to take their time to provide it. Please have that in mind when writing a question.
Hi kavekon,
let me try to help you, but you almost answered the question yourself....
... | where rank < 11
... | chart values(ETIME) over WEEK by ConcurrentProgramName
... | timechart span=1w values(ETIME) by ConcurrentProgramName
... | top ConcurrentProgramName | chart values(ETIME) values(ConcurrentProgramName)
hope this helps to get you started...
cheers, MuS
Hi kavekon, as I wrote my examples will get you started. Since I don't have your data available nor know what exactly you want to achieve, this is simply try and error. But ... | timechart span=1w values(ETIME) by ConcurrentProgramName will for sure work and if you need values for WEEK in the 3rd example, simply add values(WEEK) to the search.
Hi MuS
I have tried as suggested however all 2 answers did not give me the required results.Please help
2....| timechart values(ETIME) over WEEK by ConcurrentProgramName or ... | timechart span=1w values(ETIME) by ConcurrentProgramName
getting the error:
Error in 'timechart' command: The specifier 'over' is invalid.It must be in form
The search job has failed due to an error. You may be able view the job in the Job Inspector.
3....| top ConcurrentProgramName | chart values(ETIME) values(ConcurrentProgramName)
does not return the values per week