Hi splunkers,
I need to create a scattered x-y graph. I'm able to do it in Excel, but I need to provide a splunk equivalent.
My events are something like:
15:02 24/06/2014 Connection error
16:32 24/06/2014 Connection error
15:12 25/06/2014 Connection error
17:02 26/06/2014 Connection error
11:02 27/06/2014 Connection error
12:02 27/06/2014 Connection error
15:02 27/06/2014 Connection error
16:02 28/06/2014 Connection error
And my graph should show something like:
18:00
17:00 x
16:00 x x
15:00 x x x x
14:00
13:00
12:00 x
11:00 x
.
.
1 2 3 4 5 6 7 8 ... 23 24 25 26 27 28 29 30
any help appreciated!
Thanks!
I couldn't find a proper solution for a simple scatter chart. I guess I will dump Splunk and keep using Excel.
There are lot of questions raised here on scatter plot. Please check those. Also check splunk documentation.
Some links to help you get started
http://answers.splunk.com/answers/53097/scatter-plot-of-contingency-data-using-earthquake-data
http://answers.splunk.com/answers/1541/how-can-i-create-a-scatter-plot-of-data-points-distributed-ov...
http://answers.splunk.com/answers/104699/scatter-plot-of-some-data
http://www.splunk.com/view/SP-CAAACGB
http://docs.splunk.com/Documentation/Splunk/6.1.2/AdvancedDev/CustomChartingConfig-chartlegend#scatt...
There is trick (using line chart) to get values like that over Y-axis. In this link a splunker explains that
http://answers.splunk.com/answers/11031/how-to-convert-this-into-a-scatter-plot
Almost there! ..
index=server_log | search message="Connection error" | eval Day=strftime(_time, "%d") | eval occurence=strftime(_time, "%H%M") | table Day occurence
I still had issues with the Y Axis in Time format. I had to convert it to integer...
So now I have the basic shape, but still I have the following problems:
Any help appreciated!
Thanks