I've been messing with this all morning and still can't get the results I want. Why is this so difficult to achieve?
I have a list of how long it took to load an index for some "users". Like this:
00:15:27 aaa
00:15:07 bbb
00:10:56 ccc
00:29:36 ddd
00:24:13 eee
02:58:51 fff
00:38:33 ggg
00:21:29 hhh
00:17:44 iii
I want to create a bar or line graph for this data spanning over a few days. I'd like to show how much time it took for say "aaa" to load this index over the course of 4 days.
I'm having issues having splunk understand time formats and to display a scale of "time" based on the results, say like every 30 minutes on a chart....Do I have to convert the time to seconds, then back to a readable time for this to happen?
I tried this search. I thought "eh, this is easy!" apparently not:
sourcetype=edr daysago=4 | dedup LoadTime, users | timechart per_day(LoadTime) by users
My results are not what i'm looking for . For example, one of the times is:
00:21:29 hhh
Splunk graphs it as:
50424.000000 hhh
How can I make a graph of this data for each user across a span of time in a format of time readable???
Ok. you need to use convert to convert that field.
http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/convert
so in yourcase experiment with convert dur2sec(LoadTime) or maybe mstime()
I'll try this!
anyone have any idea if this is even possible? Would like on the left side of graph to have actual times in a scale of say, 1 hour, 2 hours, 3 hours, etc...