How to use chart command to get data over 3 variables

[atulitm]

day_receive_time="Wed, Oct 25, 2017" device_name="apple" app="mssql-db" bandwidth_consumption="161"
day_receive_time="Wed, Oct 25, 2017" device_name="apple" app="ldap" bandwidth_consumption="146"
day_receive_time="Wed, Oct 25, 2017" device_name="grape" app="syslog" bandwidth_consumption="69"
day_receive_time="Wed, Oct 25, 2017" device_name="grape" app="syslog" bandwidth_consumption="69"
day_receive_time="Wed, Oct 25, 2017" device_name="grape" app="abc" bandwidth_consumption="80"
day_receive_time="Thurs, Oct 26, 2017" device_name="apple" app="mssql-db" bandwidth_consumption="164"
day_receive_time="Thurs, Oct 26, 2017" device_name="apple" app="ldap" bandwidth_consumption="146"
day_receive_time="Thurs, Oct 26, 2017" device_name="grape" app="syslog" bandwidth_consumption="69"
day_receive_time="Thurs, Oct 26, 2017" device_name="grape" app="syslog" bandwidth_consumption="69"
day_receive_time="Thurs, Oct 26, 2017" device_name="grape" app="abc" bandwidth_consumption="80"

Trying to get data as shown in snippet :
device_name app bandwidth_consumption
Wed, Oct 25, 2017 Thurs, Oct 26, 2017
apple mssql-db 161 120
ldap 146 132
syslog 69 85
grape syslog 69 80

index | chart values(app) AS app values(bandwidth_consumption) AS bandwidth_consumption by device_name day_receive_time
this gives me desired results but problem is it creates column for app too per day where i need to see app and then how much bandwidth_consumption per day as shown above .

[niketn · Accepted solution]

@atulitm, please Try the following:

<YourBaseSearch>
| eval key=device_name."-".app
| eval day_receive_time=strptime(day_receive_time,"%a, %b %d, %Y")
|  eval _time=strftime(_time,"%y-%m-%d") 
| chart last(bandwidth_condumption) as bandwidth_consumption over key by day_receive_time cont=f
| fillnull value=0

strpttime() function is used to convert your String Time to Epoch and then later it is used to convert to String Time as YY-mm-dd using strftime() function. This format helps sort the time while keeping the format short (seems like you do need only date precision not time). Chart is used to plot Time on y-axis and key formed by combining device_name and app name on the x-axis. If you need to reverse for charting purpose you can switch the fields in over and by clause of chart.

Following is a run anywhere search on similar lines based on Splunk's _internal index to test out the same:

index=_internal sourcetype=splunkd log_level!="INFO"
|  eval key =log_level."-".host
|  eval _time=strftime(_time,"%y-%m-%d")
|  chart last(date_second) as date_seconds over key by _time cont=f
|  fillnull value=0

[atulitm]

Thanks Niket for help .. Appreciate .. With minor changes in query it works exactly i needed .

[Richfez]

I'm going to throw this out there - I am finding it difficult to envision what you want, but maybe ---

Your Search | timechart sum(bandwidth_consumption)  by day_receive_time, device_name, app

If that works, great.

If not, can you please mock up a little table of how you'd like the results? While it's not perfect and that will be OK, could you remember to use the code button (101010) in the tool bar to try formatting it into columns and rows?