graph or report based on value?

tinhuty — Fri, 02 Dec 2011 22:15:56 GMT

new to splunk, sorry if this is trivial.

by default the timeline graph are draw based on number of occurrence. I want something different.

say my log entry are like this:

Timestamp=2011/11/30 15:31:32.424, Timespent=0.4063
Timestamp=2011/11/30 15:24:16.653, Timespent=1.0156
Timestamp=2011/11/30 15:17:01.522, Timespent=0.4219
Timestamp=2011/11/30 15:09:28.907, Timespent=0.1250
Timestamp=2011/11/30 15:02:09.526, Timespent=0.1406
Timestamp=2011/11/30 14:55:10.615, Timespent=0.6875

1). is it possible to create report/graph using Timestamp field as X-axis and Timespent field as Y-axis?
2). how to create report that shows number of records(or percentage) that Timespent values are between 0-0.5 and 0.5-1.0 etc?

Thanks.

Re: graph or report based on value?

Ayn — Fri, 02 Dec 2011 22:28:24 GMT

Sure. Use timechart!

First, some explanation on how timechart behaves: timechart needs some kind of statistical function that returns a unique value for the timespan it's operating on. If you don't define the timespan yourself it will be set dynamically depending on what timerange the whole search spans, but let's take an example where the timespan is 1 minute and that somewhere in your log you have 3 of these events occurring within 1 minute. Splunk needs to know how to give you ONE value for "Value", even though there are 3 values of each. You can tell Splunk to just give you an average from the 3 events using the stats function avg:

... | timechart span=1m avg(Timespent) as Timespent

Or, if you only want the values from the first of the events within the time period, use first instead of avg. Want the sum? Use sum. And so on. More information on statistical functions is available here: http://www.splunk.com/base/Documentation/latest/SearchReference/Stats

There's also a second way to do this, which is to produce a table containing timestamps and values yourself and then feed them into the chart.

... | table _time Timespent

As for the second question, you can achieve this by using bucket to divide Timespend into the intervals you want. Like this:

... | bucket Timespent span=0.5 | stats count by Timespent

topic graph or report based on value? in Dashboards & Visualizations

graph or report based on value?

Re: graph or report based on value?