Maniupulating _time to remove 0 values from line chart

ericwindmill — Tue, 08 Dec 2020 15:27:01 GMT

I have a line chart in which I'm trying to monitor response time for a certain network call. I want to see the average response time, over time, by platform in a line chart.

Input data looks something like this:

network call #	response time (ms)	platform
1	200	web
2	250	android
3	300	web
	140	ios

and my current query looks like this:

index=myindex | search mysearch | spath response_time | spath input=request_payload output=platform path=client_properties.platform | streamstats avg(response_time) as platform_response_time by platform time_window=10m | chart first(platform_response_time) over _time by platform

This is getting my pretty close, but theres something about it that isn't "right" :

What can I do to make the line's... better? I don't even know how to phrase this, but there shouldn't be 0 values. The lines shouldn't be jumping up and backdown to 0 at every tick. They should be more "straight". The problem, I think, is that I'm creating a point for each interval of time, and there isn't a request for every platform at every interval.

Is there a way to group time intervals together in a longer period of time? i.e. there will only be a plot point for the average repsonse time each 5 minute interval? If there are truly 0 requests in 5m from a platform, that should be reflected, but it isn't likely and wouldn't happen so often.

Re: Maniupulating _time to remove 0 values from line chart

richgalloway — Tue, 08 Dec 2020 22:25:56 GMT

Use the timechart command and adjust the span until the zeros disappear.

index=myindex | search mysearch | spath response_time | spath input=request_payload output=platform path=client_properties.platform | streamstats avg(response_time) as platform_response_time by platform time_window=10m | timechart span=10m first(platform_response_time) by platform

topic Re: Maniupulating _time to remove 0 values from line chart in Splunk Search

Maniupulating _time to remove 0 values from line chart

Re: Maniupulating _time to remove 0 values from line chart