topic Re: Creating a chart by month in Dashboards & Visualizations

Creating a chart by month

elijahm — Wed, 30 Sep 2020 01:40:23 GMT

I am trying to make a line graph that shows that months of the year as the x-axis. There should be three lines in this graph. The first line should show the amount of occurrences of the "GetPolicy.doPost(56)" string in each month. The second line should show the amount of occurrences of the string "ActivateNode.doPost(94)" and the third line should show the difference of the occurrences between the two above strings. Below I calculated the difference and I am very new to splunk and I don't know how to move forward with creating the graph.

index= client_snsr_tcg_unix_webservices source="/var/log/tomcat8/catalina.out" "GetPolicy.doPost(56)"

| stats count as start

| appendcols [search index= client_snsr_tcg_unix_webservices source="/var/log/tomcat8/catalina.out" "ActivateNode.doPost(94)"

| stats count as end ]

| eval Difference=start-end

| table Difference

Re: Creating a chart by month

mayurr98 — Thu, 08 Aug 2019 20:22:00 GMT

try this:

index=client_snsr_tcg_unix_webservices source="/var/log/tomcat8/catalina.out" "GetPolicy.doPost(56)" OR "ActivateNode.doPost(94)" 
| stats count(eval(like(_raw,"%GetPolicy.doPost(56)%"))) as "GetPolicy_doPost" count(eval(like(_raw,"%ActivateNode.doPost(94)%"))) as "ActivateNode_doPost" by date_month 
| eval Difference=GetPolicy_doPost-ActivateNode_doPost

And then go to visualization and select appropriate chart to see graph view 🙂

Re: Creating a chart by month

elijahm — Thu, 08 Aug 2019 20:50:03 GMT

Thanks so much!