Splunk Search

How I can chart dates in a timechart

RobertRi
Communicator

Hi

I hope I can explain my issue.

My logfile data looks like this
Thread, Milliseconds, Command which was executed

thread1 372  command
thread2 4472 command
thread1 2292 command

Now I want to have a chart or timechart to display for each day, each thread and the summarized time
A possible solution is

| timechart span=1d sum(Milliseconds) by Thread

but I want to display these summarized Milliseconds in a human readable format like HH:MM:SS.

How can I do this or is it even possible?

Update:

How can I modify a stats statement, so that I get as list header the different headers?

Thanks for your help
Robert

Tags (1)
0 Karma
1 Solution

jtworzydlo
Path Finder
0 Karma

xiaoyuandlg
New Member

Nice to see the answer, exactly solved my question!

0 Karma

jtworzydlo
Path Finder
0 Karma

RobertRi
Communicator

how can I format the output to get the threads as heading?
I made this only with the timechart function, but is it possible with stats too?

0 Karma

jtworzydlo
Path Finder

maybe you can combine "bucket" and "stats" to achieve the same thing?
like:
bucket _time span=1d | stats sum(Milliseconds) by Thread

0 Karma

RobertRi
Communicator

Thanks for your answer.

This works well if I use the stats command but I want to use the timechart command to have the output in the following order

Time Thread1 Thread2 Thread3
2013/2/5 1:45:23 00:00:42 00:07:59
2013/2/4 00:00:00 01:00:21 10:00:01

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...