topic Re: Timechart 4 variable in Splunk Search

Timechart 4 variable

sathish2k8 — Tue, 29 Sep 2020 18:40:12 GMT

index=nil sourcetype="niller" host=*| eval flag=if(timeout>5000,"Timeout","Total")| timechart span=1m count(flag) as number_of_timeouts by flag

Above search string obtains result from both host (host1,host2). If i want to display unified value from both dashboard host=* is working but i want to display from both host and it has to show both total and timeout also.

Please help how.

Thanks. (splunk 7.0)

Re: Timechart 4 variable

mayurr98 — Sun, 25 Mar 2018 05:46:47 GMT

I do not think it is possible through timechart command
Well you need to try something like this

index=nil sourcetype="niller" host=* 
| bin _time span=1m 
| eval flag=if(timeout>5000,"Timeout","Total") 
| stats count(flag) as number_of_timeouts by flag host _time

let me know if this helps!

Re: Timechart 4 variable

sathish2k8 — Sun, 25 Mar 2018 14:57:49 GMT

it is not working my scenario, i want to distinguish both the hosts. this search is working but i have to show 2 different host in same chart. please help