topic Re: Change Column Color If Over Threshhold - Splunk License in Splunk Search

Change Column Color If Over Threshhold - Splunk License

aferone — Wed, 23 Jul 2014 13:47:46 GMT

I've looked at this link:

http://answers.splunk.com/answers/7228/change-column-color-if-over-a-range

However, I am trying to make a chart to show our Splunk license overages (past 30 days, span of 1 day). I'm not sure how to use the timechart spanning capabilities (1 day) with the existing method in the link.

Any help is appreciated, and thanks!

Re: Change Column Color If Over Threshhold - Splunk License

strive — Wed, 23 Jul 2014 17:30:53 GMT

In that example before stats use bucket. Edited Search is below

Your base search | bucket _time span=1d 
| stats count by _time
| eval high=if(count>1000,count,0)
| eval low=count-high
| fields _time,high,low

Include earliest and latest searchtime modifiers in your base search

Check if this works

Re: Change Column Color If Over Threshhold - Splunk License

strive — Wed, 23 Jul 2014 17:39:13 GMT

I tried one more way, that is

Your base search | timechart span=1d count | eval high=if(count>1000,count,0) | eval low=count-high | fields - count

Even this works.

Re: Change Column Color If Over Threshhold - Splunk License

aferone — Thu, 24 Jul 2014 13:55:50 GMT

The problem is I am not counting events. I am adding up the "kb" field in the metrics to determine how much data we logged in a day. The stats command doesn't allow me to use a varible, it seems.

Re: Change Column Color If Over Threshhold - Splunk License

strive — Thu, 24 Jul 2014 14:11:09 GMT

Can you post some sample data. That will help us to help you in a better way.

Re: Change Column Color If Over Threshhold - Splunk License

aferone — Mon, 28 Sep 2020 17:10:09 GMT

It's Splunk internal data:

index=internal source=*metrics.log group=per_index_thruput series!=*

Using the "kb" field

Re: Change Column Color If Over Threshhold - Splunk License

strive — Mon, 28 Sep 2020 17:10:15 GMT

Here you go
index=_internal source=*metrics.log group="per_index_thruput" | timechart span=1d sum(kb) as TotalKB | eval high=if(TotalKB>1000,TotalKB,0) | eval low=TotalKB-high | fields - TotalKB

More information at: http://blogs.splunk.com/2008/03/13/digging-into-metrics-log/

You can do some math and convert it into GB if you need.
eval TotalGB=TotalKB/1048576

Include earliest and latest search time modifiers as per your needs.

Re: Change Column Color If Over Threshhold - Splunk License

aferone — Fri, 25 Jul 2014 15:38:40 GMT

Thank you!