topic Re: Graph the Highest hits in a 5 minute interval per day split by a field in All Apps and Add-ons

Graph the Highest hits in a 5 minute interval per day split by a field

yechoorv — Fri, 23 May 2014 20:30:58 GMT

I want to create a graph that graphs the hits of the 5 minute interval with the maximum hits on that day. I also want to split this up by a field called MethodName:

Something like

source:__ | timechart count as hits span=5m | timechart max(hits)

That is the graph I need, but I need to split this by the field: "MethodName"

Any suggestions?

Re: Graph the Highest hits in a 5 minute interval per day split by a field

dwaddle — Sat, 24 May 2014 23:54:28 GMT

Here's an approach that looks like it should work, using Splunk's internal data as an example:

index=_internal 
| bucket span=1m _time 
| stats count by _time,source 
| timechart span=1d max(count) by source

Re: Graph the Highest hits in a 5 minute interval per day split by a field

yechoorv — Tue, 27 May 2014 12:52:57 GMT

Worked perfectly thanks!