topic Re: how do I edit my search to create mutliple graphs using timechart? in Splunk Search

how do I edit my search to create mutliple graphs using timechart?

hishamjan — Wed, 17 Feb 2021 07:25:21 GMT

index=_* OR index=* sourcetype=Kamailio BC="Current Billable Calls Count:" | rex field=_raw "Count:(?<Billablecalls>.*)" | timechart max(Billablecalls)

index=_* OR index=* sourcetype=Kamailio NBC="Current NON-Billable Calls Count:" | rex field=_raw "Calls Count:(?<NonBillableCalls>.*)" | timechart max(NonBillableCalls)

index=_* OR index=* sourcetype=Kamailio CAIB="Current Active Inbound Calls:" | rex field=_raw "Calls: (?<Inboundcalls>.*)" | timechart max(Inboundcalls)

The above three are separate searches but I would like to combine them and plot over a single Calls against Time chart. Is there any viable solution for this?

Any degree of help will be appreciated.

Re: how do I edit my search to create mutliple graphs using timechart?

ITWhisperer — Wed, 17 Feb 2021 08:12:30 GMT

It is not possible to tell from the information you have given. For example, it you combined billable call and non-billable calls, your rex expression as it stands could give you the wrong values. You should probably modify these so that each one would only work on the relevant events and not match for the irrelevant events. You would have to either share examples of all the event you are dealing with or work that out yourself.

Re: how do I edit my search to create mutliple graphs using timechart?

hishamjan — Wed, 17 Feb 2021 09:42:22 GMT

Thanks for the reply, I figured that out myself by using appendcols command but now my concern is, is there a way to calculate the total number at a given instant using multi-line graphs and also plot that on the same multi-line graph?

I've attached a screenshot of what I've achieved so far, hope it can give you an idea

Screenshot 2021-02-17 at 2.36.54 PM.png

Re: how do I edit my search to create mutliple graphs using timechart?

ITWhisperer — Wed, 17 Feb 2021 09:46:36 GMT

Yes. The timechart will have produced a table which the graph is just a visualisation of. You can eval a total field as being the sum of the three fields you already have. You can then adjust the visualisation to add an overlay specifying the total field you just created

Re: how do I edit my search to create mutliple graphs using timechart?

hishamjan — Wed, 17 Feb 2021 11:23:41 GMT

I did,

| eval totalCount = 'in_calls' + 'nb_calls' + 'b_calls' | table _time totalCalls

and displayed the total result.

Thanks a bunch, cheers!

Re: how do I edit my search to create mutliple graphs using timechart?

ITWhisperer — Wed, 17 Feb 2021 10:26:46 GMT

You don't need the table _time totalCalls at the end, the extra field is in the table, just adjust the chart format