Difficulty creating a timechart from SNMP multivalue data.

loren3737 — Tue, 29 Sep 2020 22:46:42 GMT

I am receiving SNMP data using the SNMP Modular Input application. The extraction configurated in this application is able to give a list of indexes, oids, and values. I am trying to accomplish a timechart plot of errorCounter values separated by the different compID values. Currently I am able to create a table organized in the format that I want but I cannot use the same data to create a timechart. My sample event and search are provided below.

MIB::errorCounter."0" = "12" MIB::errorCounter."1" = "23" MIB::errorCounter."2" = "9" MIB::errorCounter."3" = "13" MIB::compID."0" = "comid1" MIB::compID."1" = "acom2" MIB::compID."2" = "othercomid" MIB::compID."3" = "hi"
host = 127.0.0.1 index = main oid = errorCounter oid = errorCounter oid = errorCounter oid = errorCounter oid = compID oid = compID oid = compID oid = compID snmp_index = 0 snmp_index = 1 snmp_index = 2 snmp_index = 3 snmp_index = 0 snmp_index = 1 snmp_index = 2 snmp_index = 3 source = snmp://SNMP Sim Test sourcetype = snmp_ta value = 12 value = 23 value = 9 value = 13 value = comid1 value = acom2 value = othercomid value = hi

sourcetype="snmp_ta"

| eval d=mvzip(oid,snmp_index), e=mvzip(d,value)
| mvexpand e
| eval f1=mvfilter(match(e,".error."))
| eval f2=mvfilter(match(e,".compID."))
| eval comid=mvindex(split(f2,","),2), errorval=mvindex(split(f1,","),2)
| stats list(comid) as "Computer", list(errorval) as "Error Count" by _time

I tried the adding the line | timechart avg(errorval) by comid but no stats or visualization appears. Any help is appreciated. Thank you so much.

topic Difficulty creating a timechart from SNMP multivalue data. in Splunk Search

Difficulty creating a timechart from SNMP multivalue data.