Splunk Search

Timechart Not working after eval _time

AKG1_old1
Builder

Hello,

I am using timechart in my query. I want to create timechart based on time specified in file rather than _time (splunk injestion time). when I replace the _time with require time, it's not working. even though format is same for both of them.

Data Coulmns:
alt text

When I replace GC_TIMESTAMP with _time its not working.
alt text

Query:

   |tstats summariesonly=true values(GC.before_gc) as before_gc values(GC.max_gc) as max_gc values(GC.after_gc) as after_gc FROM datamodel=GC_ORG WHERE (nodename=GC host=TALANX_PostGoLive GC.service_name=mxmlc_gc.2017-11-06_17-20-53.log) GROUPBY GC.GC_TIMESTAMP,_time,GC.relative_time span=1s | rename GC.GC_TIMESTAMP as GC_TIMESTAMP | rename GC.relative_time as relative_time | rename GC_TIMESTAMP as _time | timechart fixedrange=false bins=2000 max(before_gc) as total_mem_before_gc,max(after_gc) as total_mem_after_gc, max(max_gc) as max_memory

Am I missing some thing ?
Thanks

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

The _time is a special field who values is in epoch but Splunk displays in human readable form in it's visualizations. Renaming your string formatted timestamp column GC_TIMESTAMP as _time will change the value as string, as oppose to epoch, hence it doesn't work. Try like this (using strptime command to convert string GC_TIMESTAMP to epoch and assigned to _time field)

  |tstats summariesonly=true values(GC.before_gc) as before_gc values(GC.max_gc) as max_gc values(GC.after_gc) as after_gc FROM datamodel=GC_ORG WHERE (nodename=GC host=TALANX_PostGoLive GC.service_name=mxmlc_gc.2017-11-06_17-20-53.log) GROUPBY GC.GC_TIMESTAMP,_time,GC.relative_time span=1s | rename GC.GC_TIMESTAMP as GC_TIMESTAMP | rename GC.relative_time as relative_time | eval _time=strptime(GC_TIMESTAMP,"%Y-%m-%d %H:%M:%S") | timechart fixedrange=false bins=2000 max(before_gc) as total_mem_before_gc,max(after_gc) as total_mem_after_gc, max(max_gc) as max_memory

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

The _time is a special field who values is in epoch but Splunk displays in human readable form in it's visualizations. Renaming your string formatted timestamp column GC_TIMESTAMP as _time will change the value as string, as oppose to epoch, hence it doesn't work. Try like this (using strptime command to convert string GC_TIMESTAMP to epoch and assigned to _time field)

  |tstats summariesonly=true values(GC.before_gc) as before_gc values(GC.max_gc) as max_gc values(GC.after_gc) as after_gc FROM datamodel=GC_ORG WHERE (nodename=GC host=TALANX_PostGoLive GC.service_name=mxmlc_gc.2017-11-06_17-20-53.log) GROUPBY GC.GC_TIMESTAMP,_time,GC.relative_time span=1s | rename GC.GC_TIMESTAMP as GC_TIMESTAMP | rename GC.relative_time as relative_time | eval _time=strptime(GC_TIMESTAMP,"%Y-%m-%d %H:%M:%S") | timechart fixedrange=false bins=2000 max(before_gc) as total_mem_before_gc,max(after_gc) as total_mem_after_gc, max(max_gc) as max_memory
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...