topic Re: Help with timechart overlay? in Splunk Search

Help with timechart overlay?

mwcooley — Tue, 29 Sep 2020 16:33:29 GMT

Hi,

I have a search that plots CPU and max Attendees over time. It's rather convoluted, and I'm wondering if there's a better way. I'm pretty new to splunk. Any suggestions?

host="freeswitch" sourcetype="cpu" | eval earliest=info_min_time | eval latest=info_max_time | multikv |
append [search host="freeswitch" sourcetype="cdr_xml" |
eval Conf_Start=strftime(startTime,"%H:%M:%S %m/%d/%y") |
eventstats count(callerName) as Attendees by Conf_Start] |
timechart span=5m max(cpu_user_percent) as CPU max(Attendees) as Attendees

thanks,
mike

Re: Help with timechart overlay?

somesoni2 — Thu, 02 Nov 2017 21:27:19 GMT

See this
http://docs.splunk.com/Documentation/Splunk/7.0.0/Viz/Chartcontrols#Chart_overlay

Re: Help with timechart overlay?

mwcooley — Thu, 02 Nov 2017 21:40:25 GMT

Thanks. I saw that, but my data comes from two different source types. i wasn't sure how to get the the data from the second source type without a separate search.

Re: Help with timechart overlay?

kmaron — Fri, 03 Nov 2017 15:17:08 GMT

I think what you really want is appendcols
http://docs.splunk.com/Documentation/Splunk/7.0.0/SearchReference/Appendcols

Re: Help with timechart overlay?

kmaron — Fri, 03 Nov 2017 15:21:17 GMT

Try this

host="freeswitch" sourcetype="cpu" 
| eval earliest=info_min_time 
| eval latest=info_max_time 
| multikv 
| timechart span=5m max(cpu_user_percent) as CPU 
| appendcols 
    [ search host="freeswitch" sourcetype="cdr_xml" 
    | eval Conf_Start=strftime(startTime,"%H:%M:%S %m/%d/%y") 
    | eventstats count(callerName) as Attendees by Conf_Start 
    | timechart span=5m max(Attendees) as Attendees]

Re: Help with timechart overlay?

mwcooley — Mon, 06 Nov 2017 18:05:14 GMT

kmaron, is your way quicker, or less processor intensive? it's definitely aesthetically better.

Re: Help with timechart overlay?

kmaron — Mon, 06 Nov 2017 18:20:24 GMT

I'm not sure if it's quicker or more efficient you'd have to run the queries and compare them. I just learned to use appendcols to put two graphs into one.

This has a nice explanation of the differences in the append type commands if that helps: https://answers.splunk.com/answers/144351/what-are-the-differences-between-append-appendpipe.html

Re: Help with timechart overlay?

mwcooley — Mon, 06 Nov 2017 18:22:10 GMT

Cool. i definitely like it better than the one i was using. thanks.