topic Re: How to show to line chart for failureCount, warningCounttimechart by time? in Splunk Search

How to show to line chart for failureCount, warningCounttimechart by time?

dezmadi — Thu, 19 May 2022 07:14:36 GMT

Hi,

I am using below query in my Dashboard

index="deng03-cis-dev-audit" | spath PATH=data.labels.verbose_message output=verbose_message | eval serviceName = mvindex(split(index, "-"), 1)."-".mvindex(split(host, "-"), 2) |search "data.labels.activity_type_name"="ViolationOpenEventv1" | where (verbose_message like "%Oldest unacked message age%evt%" or verbose_message like "%Oldest unacked message age%rec%") | eval error=case(like(verbose_message,"%above the threshold of 1800.000%"), "warning", like(verbose_message,"%above the threshold of 300.000%"), "failure") | stats values(serviceName) as serviceName count(eval(error=="failure")) as failureCount count(eval(error=="warning")) as warningCounttimechart

I want to show to line chart for failureCount, warningCounttimechart by time, I tried appending timechart span=1d count by failureCount, warningCounttimechart, but of no use

Re: Splunk multiple line chart date wise

ITWhisperer — Thu, 19 May 2022 06:09:46 GMT

Try changing

| stats values(serviceName) as serviceName count(eval(error=="failure")) as failureCount count(eval(error=="warning")) as warningCounttimechart

| timechart count by error

Re: How to show to line chart for failureCount, warningCounttimechart by time?

dezmadi — Fri, 20 May 2022 05:15:03 GMT

Thanks, it works, However I am doing like below

<search id="pubsubLatencyHighAckDelayDFBaseSearch">
<query>index="deng03-cis-dev-audit" | spath PATH=data.labels.verbose_message output=verbose_message | eval serviceName = mvindex(split(index, "-"), 1)."-".mvindex(split(host, "-"), 2) |search "data.labels.activity_type_name"="ViolationOpenEventv1" | where (verbose_message like "%Oldest unacked message age%evt%" or verbose_message like "%Oldest unacked message age%rec%") | eval error=case(like(verbose_message,"%above the threshold of 1800.000%"), "warning", like(verbose_message,"%above the threshold of 300.000%"), "failure") </query>
<earliest>$time.earliest$</earliest>

Now I want to append a line in below <row>
<panel>
<title>STATS : SLI/SLO Dashboard count</title>
<table>
<search base="pubsubLatencyHighAckDelayDFBaseSearch"></search>

</table>
</panel>
</row>
<latest>$time.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>

How can we append line in <search base="pubsubLatencyHighAckDelayDFBaseSearch"></search>?