So I am trying to plot Hours in Y axis and the Time in the X-axis (the time is the first time events related to a particular host appeared).
Please note I am accumulating time of each source (first and last event) and adding them to make total time of host (yes, I want to find exact time).
So far I have this, it gives me barplot with time (not so sure about the last line)
index=main host="*"
| stats earliest(_time) as First latest(_time) as Last by source, host
| eval difference=Last-First
| stats sum(difference) as total_difference by host
| eval total_difference = total_difference/3600
| chart max(total_difference) by host, First
I don't have date on my X-axis
I would like each host to have a different color and would like to order the hosts by date
This should do it.
index=main host="*"
| stats earliest(_time) as _time latest(_time) as Last by source, host
| eval difference=Last-_time
| stats min(_time) as _time sum(difference) as total_difference by host
| eval total_difference = total_difference/3600
| table _time host total_difference
Try this as well
index=main host="*"
| stats earliest(_time) as _time latest(_time) as Last by source, host
| eval difference=Last-_time
| stats min(_time) as _time sum(difference) as total_difference by host
| eval total_difference = total_difference/3600
| table _time host total_difference | xyseries _time host total_difference
Perhaps this is working
index=main host="*"
| stats earliest(_time) as First latest(_time) as Last by source, host | eval Date = strftime(First, "%Y-%m-%d")
| eval difference= Last-First | eval difference=difference/3600 | chart eval(sum(difference)) as total_difference over Date by host
Hi smhsplunk,
I think the last line in your query should be:
...
| chart max(total_difference) over First by host
Please see if it works. Thanks!
Hunter Shen