Splunk Search

Adding a Time Range (Extending to the Future) and Use it in a Timechart

jameldebbiche
Engager

Hi everyone,

We have logs that contain field named "var" with num data type, the value of this field changes through time, so we have two more fields in the log, startDate (when the var acquired the value written in that log) and endDate (when the var value will expire). Both dates are written in the %Y%m%d format. And of course, some of the endDate values are in the future.

I want to create a timechart where the x-axis starts from the first startDate value of the var field and ends at the latest endDate which is in the future. So my question is, after many days of research, is it possible to create a time range that is to be used in the timechart? Something like:

|eval customTimeRange = [earliest(startDate) .. latest(endDate)]
|chart values(var) over customTimeRange by source

Or something similar? Maybe it is worth mentioning, that I want it as a line chart, where the line is continuous and the last value will extend on the chart till the endDate value.

Any help would be appreciated! Thanks in advance.

0 Karma

to4kawa
Ultra Champion
your search
| eval time=mvappend(startDate,endDate)
| streamstats count as session
| mvexpand time
| eval time=strptime(time, "%Y%m%d")
| table time var
| rename time as _time
0 Karma

mydog8it
Builder

So every event has the startDate and EndDate and the var(value)? If that is correct and the x axis is the time line of start to end date, what time would you use in the event to place the var(value) on the timeline?

0 Karma

jameldebbiche
Engager

Good question, sorry I failed to clarify that, I will use another field called (objTimestamp) or even the _time field, since they are very close to each other. Thanks.

0 Karma

to4kawa
Ultra Champion

Use it in a Timechart
what's y-axis?

0 Karma

jameldebbiche
Engager

Y axis will be the var value. But timechart will only use _time on the x axis and not the custom range of the earliest startDate and the latest endDate, so that is not I am not using timechart.

0 Karma

to4kawa
Ultra Champion

If earliest startDate and the latest endDateis epoch, timechart can be.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...