topic Re: Multiple Timecharts by a field in single search in Splunk Search

Multiple Timecharts by a field in single search

nagpalga — Wed, 29 Jul 2020 17:01:44 GMT

I wanted to create multiple timecharts in a single search. The scenario i am stuck in is something like this :

index = "A" sourcetype = "B" | where Activity_type = "Activity1" | timechart span=10m count by Event_Type

There are multiple activity_type fields and i want multiple timecharts by Event_Type for different Activity_type in a single search.

Thanks in advance for your help.

Re: Multiple Timecharts by a field in single search

j0e3gan — Sat, 20 Feb 2021 16:05:52 GMT

I would like to do the same in a dashboard if possible -- generate a timechart per host in the search results. Might someone be able to provide some insight here, even point to similar question that has been answered? Thanks.

Re: Multiple Timecharts by a field in single search

ITWhisperer — Mon, 22 Feb 2021 16:56:06 GMT

In your dashboard, near the top of the simpleXML, you can have a base search

<search id="base_search"> <query>index = "A" sourcetype = "B" | timechart span=10m count by Activity_type, Event_Type</query>

Then in each dashboard panel, you set the query to be based on your base search with the additional where clause

<chart> <search base="base_search"> <query>| search "Activity1"</query> </search>

Re: Multiple Timecharts by a field in single search

tscroggins — Sat, 20 Feb 2021 18:23:08 GMT

I've used the trellis option to achieve this. For example:

index=_internal sourcetype=splunkd source=*/splunkd.log*
| bin _time span=10m
| stats count(eval(case(log_level=="ERROR", log_level))) as ERROR count(eval(case(log_level=="WARN", log_level))) as WARN count(eval(case(log_level=="INFO", log_level))) as INFO by _time component

will produce a table of log_level counts by _time and component:

_time	component	ERROR	WARN	INFO
2021-02-20 11:00	AdminManager	0	1	0
...	...	...	...	...

In the chart configuration, enable trellis and split by the desired field. I split by component in this example to display counts of events by log_level over time per component.

Re: Multiple Timecharts by a field in single search

j0e3gan — Mon, 22 Feb 2021 16:49:42 GMT

Trellis options give me a timechart per server using my browser, which is perfect. Only downside for me is that PDF export does not support trellis options, but this is still a handy approach when PDF export is not a concern. Thanks!

Re: Multiple Timecharts by a field in single search

j0e3gan — Mon, 22 Feb 2021 17:04:12 GMT

In the dashboard where I tested your suggestion, a base search in the related panel followed by a post-process search in each of the panel's charts works well -- gives me a timechart per server both in my browser and PDF exports. Only downside is having to know the number of servers to prepare a chart with a post-process search per server, which is not quite as clean as the trellis option mentioned that dynamically produces charts for n servers. Still, compatibility with PDF exports requires tradeoffs with maintainability in my experience, so this solution is great when I need it. Thanks!