Splunk Search

How to create chart from 2 different fields

spisiakmi
Communicator

Hi. I have a table with 3 columns. A B C. A=time, B=run, C=wait
Explenation of the table: the process runs from A2 (11.03.2015 14:54:32) and the status run=1. The status wait=0. The process ends at 11.03.2015 14:56:28 and the status run=0 and status wait=1. The run process takes 116s. The wait process takes 42s. The whole sequence repeats. Only delta of the time values differs.

time    run wait
11.03.2015 14:54:32 1   0
11.03.2015 14:56:28 0   1
11.03.2015 14:57:10 1   0
11.03.2015 14:59:06 0   1
11.03.2015 14:59:58 1   0
11.03.2015 15:01:57 0   1
11.03.2015 15:02:15 1   0

How can I build such a chart, which will have:
x-axis: column A (time) from the table
y-axis: boolean 0 or 1.
and columns B and C will be displayed in time (column chart). The width of each run or wait column should depends on, how many seconds take the run or wait process. There should be no blank space between the columns in the chart, because the whole process (run wait run wait ...) is fowing continuously.
Can anybody have any idea, how to fix it, please?

0 Karma
1 Solution

cpetterborg
SplunkTrust
SplunkTrust

Does something like this do what you want?:

<your search> 
| timechart values(run) as x1, values(wait) as x2 span=1s 
| filldown x1, x2

View solution in original post

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

Does something like this do what you want?:

<your search> 
| timechart values(run) as x1, values(wait) as x2 span=1s 
| filldown x1, x2
0 Karma

spisiakmi
Communicator

Hi, yes, you are right. It is working. In fact, before that, I need to adjust the _time like this:
| eval NewTime=strptime(time,"%d.%m.%Y %H:%M:%S")
| eval _time=NewTime
| timechart values(run) as x1, values(wait) as x2 span=1s
| filldown x1, x2

thank you very much

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...