Dashboards & Visualizations

scattered x-y graph - day number in X and time in Y

snemiro_514
Path Finder

Hi splunkers,

I need to create a scattered x-y graph. I'm able to do it in Excel, but I need to provide a splunk equivalent.

My events are something like:

15:02 24/06/2014 Connection error
16:32 24/06/2014 Connection error
15:12 25/06/2014 Connection error
17:02 26/06/2014 Connection error
11:02 27/06/2014 Connection error
12:02 27/06/2014 Connection error
15:02 27/06/2014 Connection error
16:02 28/06/2014 Connection error

And my graph should show something like:

18:00
17:00 x
16:00 x x
15:00 x x x x
14:00
13:00
12:00 x
11:00 x
.
.
1 2 3 4 5 6 7 8 ... 23 24 25 26 27 28 29 30

any help appreciated!

Thanks!

Tags (2)

snemiro_514
Path Finder

I couldn't find a proper solution for a simple scatter chart. I guess I will dump Splunk and keep using Excel.

0 Karma

strive
Influencer

There is trick (using line chart) to get values like that over Y-axis. In this link a splunker explains that
http://answers.splunk.com/answers/11031/how-to-convert-this-into-a-scatter-plot

snemiro_514
Path Finder

Almost there! ..

index=server_log | search message="Connection error" | eval Day=strftime(_time, "%d") | eval occurence=strftime(_time, "%H%M") | table Day occurence

I still had issues with the Y Axis in Time format. I had to convert it to integer...
So now I have the basic shape, but still I have the following problems:

  • The Y scale is numeric. I need Hour:Minutes
  • There are only two horizontal lines. I need one per hour. The majorUnit in the axisY didn't do the trick.

Any help appreciated!

Thanks

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...