topic Re: query help with chart in Splunk Search

query help with chart

surekhasplunk — Fri, 29 Mar 2019 09:22:11 GMT

Hi,

I have a csv file with inputs like this :

Time,Device,Interface,Duration,Bits In/sec,Bits Out/sec,BW
3/22/2019 12:26,A-01,Ethernet1/1,322,0.00000255,0.00000247,10000000000
3/22/2019 12:31,A-01,Ethernet1/1,317,0.00000247,0.00000247,10000000000
3/22/2019 12:37,A-01,Ethernet1/1,319,0.00000242,0.0000025,10000000000
3/22/2019 12:42,A-01,Ethernet1/1,320,0.00000248,0.0000024,10000000000

Now i need to show it in a graph like the attached picture where i can show in
x-axis the bandwidth usage and
y-axis i need Device:Interface name
and the usage details should come in the graph as shown in the screenshot. Please help asap.

Re: query help with chart

renjith_nair — Sat, 30 Mar 2019 09:05:45 GMT

@surekhasplunk,

Try

"your current search"
|eval Interfaces=Device.":".Interface
|stats sum("Bits In/sec") as BitsIn,sum("Bits Out/sec") as BitsOut by Interfaces

Re: query help with chart

niketn — Sat, 30 Mar 2019 15:31:16 GMT

@surekhasplunk I am confused. You have the data with fields and you have the expected chart in Splunk. Don't you already have the query? Is it assistance required with some assignment? or do you want something on top of the chart that has been attached?

Re: query help with chart

woodcock — Mon, 01 Apr 2019 06:07:00 GMT

Like this:

... | eval bandwidthIn = Duration * 'Bits In/sec'
| eval bandwidthOut = Duration * 'Bits Out/sec'
| eval Device:Interface = Device . ":" . Interface
| stats sum(bandwidthIn) AS bandwidthIn sum(bandwidthOut) AS bandwidthOut BY Device:Interface

Re: query help with chart

surekhasplunk — Mon, 01 Apr 2019 06:21:06 GMT

Thank you so much.

Re: query help with chart

surekhasplunk — Tue, 02 Apr 2019 08:01:27 GMT

Hi @woodcock,

Whats the logic behind multiplying Duration with 'Bits In/Sec' and if we are multiplying with duration then should we not divide it by BW value ? Please suggest.

Re: query help with chart

woodcock — Tue, 02 Apr 2019 15:07:16 GMT

You said you desired Bandwidth usage; that is how to calculate usage.

Re: query help with chart

surekhasplunk — Wed, 03 Apr 2019 06:58:02 GMT

Ok.. thanks much @woodcock