topic Re: How do I generate a histogram from a comma separated list of numbers? in Dashboards & Visualizations

How do I generate a histogram from a comma separated list of numbers?

Magrilloc — Mon, 19 Sep 2016 07:38:20 GMT

I have events formatted like this:

09/19/16 07:07:00 | Name=ABC123 Host=MyHost123.com
ProcessHistogram2: 0,0,0,0,0,0,0,1,0,34,66,66,64,68,60,79,7374,13812,0,0,0,0,0,0,0,0,0,0

I am trying to generate an aggregate (min,average and max) histogram chart over time where each comma separated value is a bucket.

I have some control over the data format, so I can rearrange the event formatting if it makes the search easier.

Doing it in excel would result in something like this:

Re: How do I generate a histogram from a comma separated list of numbers?

sundareshr — Mon, 19 Sep 2016 23:28:18 GMT

Try this

Name=123 Host=ABC | rex "ProcessHistogram2\:\s(?<ph>[^\s]+)" | eval times="0,1,2,3,4,5,6,7,8,9,10,20,30,40,50,60,70,80,90,100,200,300,400,500,600,700,800,900" | makemv ph delim="," | makemv times delim="," | eval z=mvzip(times, ph) | mvexpand z | rex field=z "(?<t>[^\,]+)\,(?<ph>.*)" | table _time t ph | chart values(ph) as ph over t by _time

http://docs.splunk.com/Documentation/Splunk/6.4.3/SearchReference/Chart

Re: How do I generate a histogram from a comma separated list of numbers?

Magrilloc — Tue, 20 Sep 2016 17:42:08 GMT

When I try this I get an table with only time stamps in it and no data in the ph column. I removed the chart command as it was returning no data for me to inspect.

Re: How do I generate a histogram from a comma separated list of numbers?

sundareshr — Tue, 20 Sep 2016 17:50:37 GMT

Try this search "as-is". This is a run-anywhere sample. See if this gives you the desired results

| makeresults | eval ph="0,0,0,0,0,0,0,1,0,34,66,66,64,68,60,79,7374,13812,0,0,0,0,0,0,0,0,0,0" | eval times="0,1,2,3,4,5,6,7,8,9,10,20,30,40,50,60,70,80,90,100,200,300,400,500,600,700,800,900" | makemv ph delim="," | makemv times delim="," | eval z=mvzip(times, ph) | mvexpand z | rex field=z "(?<t>[^\,]+)\,(?<ph>.*)" | table _time t ph | chart values(ph) as ph over t by _time