Re-use host field in Timechart for count aggregation

joshuagray — Thu, 09 Aug 2018 22:08:00 GMT

I am attempting to create a dynamic timecharted trellis dashboard panel that only shows an aggregation by host based on which host fields are present in the main search.

As an example, the below shows two trellis panels, split by sourcetype using a statically assigned host names.

index=* sourcetype=* host=host1 OR host=host2 
| timechart span=1s count(eval(host == "host1")) as "host1" count(eval(host == "host2")) as "host2" count by sourcetype

What I would like is the number of Trellis panels (aggregated by host) to shrink or grow based on the number of hosts listed in the primary search.

Programmatically this would be something like a for loop over the host aggregation to create multiple panels, depending on the number of host values present.

i.e.

index=* sourcetype=* host=host1 OR host=host2 
| timechart span=1s count(eval(host == )) as "" count by sourcetype

With the expanded search evaluating to something like the below, assuming 3 hosts.

index=* sourcetype=* host=host1 OR host=host2 OR host=3
| timechart span=1s count(eval(host == "host1")) as "host1" count(eval(host == "host2")) as "host2" count(eval(host == "host3")) as "host3" count by sourcetype

Any help would be appreciated!
Thanks.

Re: Re-use host field in Timechart for count aggregation

DalJeanis — Sat, 11 Aug 2018 06:02:22 GMT

See the answer by @niketnilay on this one, which includes the full code for a similar solution.

https://answers.splunk.com/answers/623803/trellis-display-of-two-values.html

However, I believe you may need to swap the order of your fields. That is, the "by" field may need to be by host if you want the trellis to break the results by host. Try it the way you have it and see if it works. If not, then swap it and see if that works.

topic Re: Re-use host field in Timechart for count aggregation in Splunk Dev

Re-use host field in Timechart for count aggregation

Re: Re-use host field in Timechart for count aggregation