visualizationsplunk

How to create a timechart in splunk for the timestamp and extracted field?


I'm trying to create a timechart for timestamp of each event and TotalTimeTaken value in splunk.

My query:

index=XYZ  Total Time Taken  StudentController   
| rex "Total Time Taken: (?<TotalTimeTaken>[^,}]+)"
| timechart  TotalTimeTaken limit=5

Expected data table:

_time TotalTimeTaken
2024-04-03T06:27:07.371-04:00 52 ms
2024-04-03T06:27:07.328-04:00 23 ms
2024-04-03T06:27:07.306-04:00 24 ms
2024-04-03T06:27:07.293-04:00 74 ms
2024-04-03T06:27:07.283-04:00 22 ms

But the timechart is not coming as expected. Need the exact values of TotalTimeTaken instead of count.

Is there any way to build the chart from the existing dataset? I have created the dataset as shown in the above table. How to use this table dataset and create a line chart out of it?


Solution

  • I see two problems here. The first is the timechart command requires numeric data, but the TotalTimeTaken field is a string because of the "ms". That's easy to handle. The second problem is the timechart command has a minimum resolution of 1 second so it is unable to graph 5 values in the same second. Handle that by using an aggregation function (max, min, avg, etc.).

    Here's a run-anywhere example using the sample data.

    | makeresults 
    | eval _raw="_time  TotalTimeTaken
    2024-04-03T06:27:07.371-04:00   52 ms
    2024-04-03T06:27:07.328-04:00   23 ms
    2024-04-03T06:27:07.306-04:00   24 ms
    2024-04-03T06:27:07.293-04:00   74 ms
    2024-04-03T06:27:07.283-04:00   22 ms"
    | multikv forceheader=1
    | eval _time=strptime(time_,"%Y-%m-%dT%H:%M:%S.%3N%:z")
    ``` Above sets up test data.  Skip IRL ```
    ``` Strip out the unit label ```
    | rex field=TotalTimeTaken "(?<TotalTimeTaken>\d+)"
    | timechart values(TotalTimeTaken) limit=5