topic Re: For each each host for each eventtype, chart the number of occurences including its respective threshold in Splunk Search

How to chart the number of occurrences including its respective threshold for each host and each eventtype?

zapping575 — Tue, 03 May 2022 15:59:44 GMT

Hi everybody,

I have the following problem and cannot seem to be able to wrap my head around it:

I have a bunch of eventtypes (close to 1000).
Some of those eventtypes have certain thresholds which are greater than zero. I look the values up from a csv
For a single host, I'd like to
1. Chart the number of occurrances for an eventtype IF
  1. That number of occurrances is higher than the aforementioned threshold
  2. The chart shall also contain a static line depicting the threshold value

Here is what I have so far. I believe I am always getting lost when using an aggregate function such as count() because added something to the result using eval just wont work.

What I do understand is that I have to add the "Threshold" variable in the overlay Options of the chart.

Any help is much appreciated. Thank you

Re: For each each host for each eventtype, chart the number of occurences including its respective threshold

ITWhisperer — Tue, 03 May 2022 08:13:09 GMT

| stats count values(alert_threshold) as alert_threshold by eventtype

Re: For each each host for each eventtype, chart the number of occurences including its respective threshold

zapping575 — Tue, 03 May 2022 09:56:42 GMT

Thank you very much. I got it working as expected like this:

index="my_index" eventtype=* host="dropdown_value..." | lookup my_lookup eventtype | stats count values(alert_threshold) as alert_threshold by eventtype | where alert_threshold > 0 AND count > alert_threshold | sort count desc

Now the only thing left is that the threshold value is drawn as a dot in the chart. I'd like it to be a line going across the entire bar. Is that possible?

Re: For each each host for each eventtype, chart the number of occurences including its respective threshold

ITWhisperer — Tue, 03 May 2022 10:14:34 GMT

You will get a dot if there is only 1 point on the line e.g. only one event type breaches the threshold

Re: For each each host for each eventtype, chart the number of occurences including its respective threshold

zapping575 — Tue, 03 May 2022 14:23:00 GMT

Acknowledged. thanks