topic Re: Display data from all host in timeline in Dashboards & Visualizations

Display data from all host in timeline

mchandx — Fri, 20 Apr 2012 14:14:48 GMT

Hello,

I need to create a stacked area graph displaying all data for all hosts in the environment. I have the visualization created, but I do not know the proper syntax.

Re: Display data from all host in timeline

cramasta — Fri, 20 Apr 2012 14:21:17 GMT

Some more information on what type of data you are trying to display would help.

you could see how many events you are collecting by host over time by doing this

index=main * | timechart span=1d count by host

span=1d will show how many events each host collects for each date. You can change it to span=1h if you would like to see how much each collects in a hour

Re: Display data from all host in timeline

mchandx — Fri, 20 Apr 2012 14:35:27 GMT

That is essentially what I am looking for. I want to graph the amount of logs indexed per host since midnight of the current day, graphed by hosts.

So the graph the x-axis would show time and the y-axis would be an integer of how many total logs generated by the entire network. That integer would then be broken down by hosts. Here's a picture kind of showing the look that I am trying to achieve:
http://1.bp.blogspot.com/-OmyYzNNKZE0/Tmls2yFeGcI/AAAAAAAAABY/uCzqQxB3ZDE/s1600/Selection_015.png

Re: Display data from all host in timeline

yannK — Fri, 20 Apr 2012 14:38:39 GMT

if you have a lot of hosts, to avoid having a column with "OTHERS" for the 10+ hosts.
You may want to add at the end : useother=0

Re: Display data from all host in timeline

cramasta — Fri, 20 Apr 2012 14:41:03 GMT

Then the example i provided will do just that. However beware of the timeframe that are are plotting agaist when using the span function. If you do

|timechart span=1m count by host

over the past 1 year there will not be enough room to plot all of the data points and the chart wont look right. You can just leave the span=1d part out all together and splunk will pick the correct grouping method

Re: Display data from all host in timeline

mchandx — Fri, 20 Apr 2012 14:50:06 GMT

I tried that, and this is what I got:

http://i42.tinypic.com/3480l6o.png

The blacked out sections are hosts