scattered x-y graph - day number in X and time in Y

[snemiro_514]

Hi splunkers,

I need to create a scattered x-y graph. I'm able to do it in Excel, but I need to provide a splunk equivalent.

My events are something like:

15:02 24/06/2014 Connection error
16:32 24/06/2014 Connection error
15:12 25/06/2014 Connection error
17:02 26/06/2014 Connection error
11:02 27/06/2014 Connection error
12:02 27/06/2014 Connection error
15:02 27/06/2014 Connection error
16:02 28/06/2014 Connection error

And my graph should show something like:

18:00
17:00 x
16:00 x x
15:00 x x x x
14:00
13:00
12:00 x
11:00 x
.
.
1 2 3 4 5 6 7 8 ... 23 24 25 26 27 28 29 30

any help appreciated!

Thanks!

[snemiro_514]

I couldn't find a proper solution for a simple scatter chart. I guess I will dump Splunk and keep using Excel.

[strive]

There are lot of questions raised here on scatter plot. Please check those. Also check splunk documentation.

Some links to help you get started

http://answers.splunk.com/answers/53097/scatter-plot-of-contingency-data-using-earthquake-data
http://answers.splunk.com/answers/1541/how-can-i-create-a-scatter-plot-of-data-points-distributed-ov...
http://answers.splunk.com/answers/104699/scatter-plot-of-some-data

http://www.splunk.com/view/SP-CAAACGB
http://docs.splunk.com/Documentation/Splunk/6.1.2/AdvancedDev/CustomChartingConfig-chartlegend#scatt...

[strive]

There is trick (using line chart) to get values like that over Y-axis. In this link a splunker explains that
http://answers.splunk.com/answers/11031/how-to-convert-this-into-a-scatter-plot

[snemiro_514]

Almost there! ..

index=server_log | search message="Connection error" | eval Day=strftime(_time, "%d") | eval occurence=strftime(_time, "%H%M") | table Day occurence

I still had issues with the Y Axis in Time format. I had to convert it to integer...
So now I have the basic shape, but still I have the following problems:

• The Y scale is numeric. I need Hour:Minutes
• There are only two horizontal lines. I need one per hour. The majorUnit in the axisY didn't do the trick.

Any help appreciated!

Thanks