Splunk Search

extracted date as x-axis range

athorat
Communicator

got a date extracted from a file name and got the count of files received on for that extracted date.

date-2016-03-28 extracted from the files received at a specific location.

 /ubidata/axway/JourneyData/AAA_NA_70_2016-03-28-00-47-08_353466071286872_1HGCR2F5XDA159398_0_0.zip

Now we want a time chart to show the count of extracted date(2016-03-28) on that date.
The default timechart shows values by system time. Want to use the extracted date as the xaxis date and showing the timechart trend for those counts.

Thanks.

Tags (3)
0 Karma

Jeremiah
Motivator

Convert your date to an epoch timestamp, and eval it to _time:

... | eval _time = strptime(file_date, "%F") | timechart dc(source)

0 Karma

athorat
Communicator

Hi @Jeremiah

Thanks for the update, we see an notification under the job tab :
Some events were removed by Timeliner because they were missing _time[p01apl385.ent.com] Some events were removed by Timeliner because they were missing _time

is there something which needs to be modified.

Thanks.

0 Karma

woodcock
Esteemed Legend

Your regex to create file_date is probably buggy. Try this to find broken events and enhance your field extraction:

... | where isnull(file_date)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...