Splunk Search

Show time in minutes on the Y axis

yrajabi1
Engager

Hello, I have a set of data that I have shared below that I am charting with a line against the source. I cannot get the time(in minutes) to be on the Y axis. Any advice would be appreciated.

index=advantage sourcetype=searchtimes source="build." | transaction startswith="About to start Index Build" endswith="Time taken for index build"| eval timedur= (duration)/60 | convert timeformat=%M:%S ctime(timedur) | chart first(timedur) by source

1 C:\SPLUNK\build.log.20130217 02:01
2 C:\SPLUNK\build.log.20130218 02:04
3 C:\SPLUNK\build.log.20130219 02:05
4 C:\SPLUNK\build.log.20130220 02:08
5 C:\SPLUNK\build.log.20130221 02:12
6 C:\SPLUNK\build.log.20130222 02:09
7 C:\SPLUNK\build.log.20130223 02:15
8 C:\SPLUNK\build.log.20130224 02:10
9 C:\SPLUNK\build.log.20130225 02:16

In my XML I have this..
P0Y0M0DT0H15M0S
P0Y0M0DT0H0M0S
line
1

Thanks!!

0 Karma

davecroto
Splunk Employee
Splunk Employee

When I run this timechart the graph brakes the "x axis" into minutes.

index=_internal earliest=-1m |timechart span=60s count by group

You are specifying a line chart. If you want to show minutes or time on the y axis, would it make sense to use a column instead of a line?

0 Karma

davecroto
Splunk Employee
Splunk Employee

Maybe this example makes more sense. In a column of course

index=_internal earliest=-1m |eval desired_time=strftime(_time, "%I:%M:%S %p") |chart count by desired_time

0 Karma
Get Updates on the Splunk Community!

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...