Splunk Search

How to create chart from 2 different fields

spisiakmi
Communicator

Hi. I have a table with 3 columns. A B C. A=time, B=run, C=wait
Explenation of the table: the process runs from A2 (11.03.2015 14:54:32) and the status run=1. The status wait=0. The process ends at 11.03.2015 14:56:28 and the status run=0 and status wait=1. The run process takes 116s. The wait process takes 42s. The whole sequence repeats. Only delta of the time values differs.

time    run wait
11.03.2015 14:54:32 1   0
11.03.2015 14:56:28 0   1
11.03.2015 14:57:10 1   0
11.03.2015 14:59:06 0   1
11.03.2015 14:59:58 1   0
11.03.2015 15:01:57 0   1
11.03.2015 15:02:15 1   0

How can I build such a chart, which will have:
x-axis: column A (time) from the table
y-axis: boolean 0 or 1.
and columns B and C will be displayed in time (column chart). The width of each run or wait column should depends on, how many seconds take the run or wait process. There should be no blank space between the columns in the chart, because the whole process (run wait run wait ...) is fowing continuously.
Can anybody have any idea, how to fix it, please?

0 Karma
1 Solution

cpetterborg
SplunkTrust
SplunkTrust

Does something like this do what you want?:

<your search> 
| timechart values(run) as x1, values(wait) as x2 span=1s 
| filldown x1, x2

View solution in original post

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

Does something like this do what you want?:

<your search> 
| timechart values(run) as x1, values(wait) as x2 span=1s 
| filldown x1, x2
0 Karma

spisiakmi
Communicator

Hi, yes, you are right. It is working. In fact, before that, I need to adjust the _time like this:
| eval NewTime=strptime(time,"%d.%m.%Y %H:%M:%S")
| eval _time=NewTime
| timechart values(run) as x1, values(wait) as x2 span=1s
| filldown x1, x2

thank you very much

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...