topic Re: Not able to create a 24hour chart with the table. in Splunk Search

Not able to create a 24hour chart with the table.

theouhuios — Fri, 19 Oct 2012 17:43:18 GMT

Hello

I am trying to do a 24hr and 31 days chart for the threshold value which will be as a output of this table. Now the below code gives me threshold value for each workgroup. I now need to create a timechart which mentions about the number of times the threshold for a particular workgroup(A) is exceeded.

index=xxxx search_name="xxxx" | rename record_assignmentGroup as A | eval mybucket=case(date_hour<4,1,date_hour<8,2,date_hour<12,3,date_hour<16,4,date_hour<20,5,date_hour>0,6) | stats count as I by A, mybucket,date_mday,date_month,date_year  | delta I as D  | eval D = abs(D) | eventstats avg(I) as xbar, avg(D) as mbar by A | eval threshold = xbar + (2.66*mbar) | eval threshold=coalesce(threshold,0) | dedup A | fields A threshold | table A threshold

I made use of macro and now the search is

index=xxxx search_name="xxxx"  |  `bucket_incident` | `threshold_incident`|

It's just a shorter version of the first one.

Output:

A threshold

Regards

theou

Re: Not able to create a 24hour chart with the table.

bmacias84 — Fri, 19 Oct 2012 20:37:45 GMT

I am not sure what you trying to do exactly, but you need to perserve _time to use timechart or to use chart use (chart count over time by x) in your stats command and eventstats.

Re: Not able to create a 24hour chart with the table.

theouhuios — Fri, 19 Oct 2012 20:42:39 GMT

I should have been a bit more clear. Will update the part now.

Re: Not able to create a 24hour chart with the table.

theouhuios — Fri, 19 Oct 2012 20:48:45 GMT

@bmacias84 I updated it now. Any idea on how to solve this.

Re: Not able to create a 24hour chart with the table.

yannK — Sat, 20 Oct 2012 17:17:04 GMT

if your grouping is per time bucket (mybucket), then keep it at every steps of your commands : stats, fields, etc...
and at the end your probably want |table A mybucket threshold

Re: Not able to create a 24hour chart with the table.

bmacias84 — Mon, 28 Sep 2020 12:40:16 GMT

@theouhuios, Could you explain what your trying to accomplish with your case statment?



eval mybucket=case(date_hour<4,1,date_hour<8,2,date_hour<12,3,date_hour<16,4,date_hour<20,5,date_hour>0,6)