topic Re: Timeseries graph based on multiple fields in Splunk Search

How to best approach timeseries graph based on multiple fields?

AKG11 — Tue, 08 Nov 2022 15:52:59 GMT

Hi,

I am looking to create timeseries graph based on multiple fields.
we could have multiple hosts and each host have multiple CPU.
Looking best approach to visualize it.

Thanks

Re: Timeseries graph based on multiple fields

ITWhisperer — Mon, 07 Nov 2022 11:15:10 GMT

It depends on what you are trying to show!

You could use a trellis format, one tile for each host, or you could concatenate the host and cpu into a single field and display them all on one chart.

Re: Timeseries graph based on multiple fields

AKG11 — Mon, 07 Nov 2022 11:30:27 GMT

@ITWhisperer Thanks. I tried that but I am not be able to split by host.

Any idea ?

Re: Timeseries graph based on multiple fields

ITWhisperer — Mon, 07 Nov 2022 11:34:08 GMT

For trellis, you need to keep host and cpu separate - try something like this

| bin _time span=1m | stats avg(value) as avg by _time host CPU

If you want them all on the same chart, then you concatenate host and cpu

Re: Timeseries graph based on multiple fields

AKG11 — Mon, 07 Nov 2022 11:45:49 GMT

@ITWhisperer I think it will be better to have separate graph for each host.

I tried what you suggested but it doesn't seems like working. Infact its not changing any thing in results. Am I missing something ?
basically in one chart it should show all CPU graph for single host.

Re: Timeseries graph based on multiple fields

ITWhisperer — Mon, 07 Nov 2022 11:59:47 GMT

Try this

| bin _time span=1m | stats avg(value) as avg by _time host cpu | eval {cpu}=avg | fields - avg cpu