Dashboards & Visualizations

histogram creation query

surekhasplunk
Communicator

Hi,

I have a query which currently shows the port usage. Now i want to show the same for each month. i.e. for a span of 1 month.
Somehow my code is not working can you please help.

index=bla bla query
Tags (2)
0 Karma
1 Solution

Sukisen1981
Champion

something like this?

    | bin span=1mon _time |  stats count(type) by _time,Value,linkSpeed

View solution in original post

0 Karma

Sukisen1981
Champion

something like this?

    | bin span=1mon _time |  stats count(type) by _time,Value,linkSpeed
0 Karma

surekhasplunk
Communicator

Hi @Sukisen1981

Thanks for the reply my time field is called lastUpdated and the value looks like this : 2019-04-16T04:28:58+02:00

So when i try to put span=1mon it atually gives all records rather than spanning it for 1 month.
Do i need to edit the lastUpdated field to get only the date rather than the full date and time ?

Please help

0 Karma

Sukisen1981
Champion

hi @surekhasplunk
Yes , remember I am applying the bin command on _time , but you have a custom time field, so
| eval lastUpdated=strptime(lastUpdated,"%Y-%m-%d") |eval _time=lastUpdated|bin span=1mon _time |rest of the stuff....

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...