topic Re: troublesome charting in Splunk Search

troublesome charting

tuxford — Mon, 28 Sep 2020 12:11:09 GMT

Hello

I have a chart that works for a time range of 60 minutes and looks like this:

sourcetype="access_combined" "*.html" OR ".ajax" NOT "/tomcat-docs/healthcheck.html" | where other>0 | eval avg_sec=other/1000 | chart avg(avg_sec) by date_minute

This gives me an average for each minute of that hour, I would like to do the same for longer time periods but are unable to find out how. If I extend the time range it sums the same minutes for each hour and makes an average of that instead of treating every minute of each hour as a separate entity. Anyone know a fix?

Re: troublesome charting

Paolo_Prigione — Thu, 02 Aug 2012 10:47:29 GMT

You should use the timechart command

sourcetype="access_combined" "*.html" OR ".ajax" NOT "/tomcat-docs/healthcheck.html" | where other>0  | eval avg_sec=other/1000 | timechart span=1m avg(avg_sec)

Re: troublesome charting

tuxford — Thu, 02 Aug 2012 10:52:37 GMT

Still seeing some odd results, seems the results change depending on how long the time range is, if I use 4 hours I get peaks around 30 and when I use 24 hours I only get peaks around 12 so the average calculations seems to differ somehow.

Re: troublesome charting

Paolo_Prigione — Thu, 02 Aug 2012 11:50:51 GMT

Have you tried to modify the way charts deal with nulls? You might try "treat as zeros".

Re: troublesome charting

tuxford — Thu, 02 Aug 2012 13:21:28 GMT

Yes, I've tried a lot of different ways now limited success. Basically what I want is to create an average that spans 1 minute in a larger time range where the chart is shown in a good way. It might be that my time range is too large when using a span of 1 minute and it simply won't work?

Re: troublesome charting

Paolo_Prigione — Mon, 28 Sep 2020 12:11:11 GMT

The x axis can plot max 1000 points, and there are 1440 mins in a day. So it might be too wide. However, try to use "stats" to be sure you're getting the averages correct: sourcetype="access_combined" "*.html" OR ".ajax" NOT "/tomcat-docs/healthcheck.html" | where other>0 | eval avg_sec=other/1000 | bucket _time span=1m | stat avg(avg_sec)