Splunk Search

How to create a line chart with received time on Y axis and date on X axis?

Curiuu
Engager

I'm looking to create a line chart like the attached picture. The data points would be the time a file is received, there are 5 different files, so it would be a multi-line chart. My most recent attempt was using someone's example of this query. It does work to an extent, but the received time is converted to a decimal which isn't the best for my use case.

| eval t=split(strftime(_time, "%H:%M:%S"), ":")
| eval h=mvindex(t,0), m=mvindex(t,1), s=mvindex(t,2)
| eval v=(h)+(m/100)
| bin _time span=1d
| chart max(v) over _time by job

 

Labels (1)
0 Karma

woodcock
Esteemed Legend

Something like this:

index=_internal
| eval date_hour = strftime(_time, "%H")
| bin _time span=1d
| stats count BY date_hour _time
| sort 0 - count
| timechart span=1d first(date_hour) AS busiest_hour

0 Karma

somesoni2
Revered Legend

Try something like this

| eval t=split(strftime(_time, "%H:%M:%S"), ":")
| eval h=mvindex(t,0), m=mvindex(t,1), s=mvindex(t,2)
| eval v=(h)+(m/100)
| eval day=strftime(_time,"%F")
| chart max(v) over day by job
0 Karma
Get Updates on the Splunk Community!

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

A Guide To Cloud Migration Success

As enterprises’ rapid expansion to the cloud continues, IT leaders are continuously looking for ways to focus ...

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...