topic Re: timechart dynamic fields in Splunk Search

timechart dynamic fields

jibiuthaman — Mon, 28 Sep 2020 15:54:42 GMT

Took the below example from documentation....

Chart a single day's views and purchases at the Buttercup Games online store.

sourcetype=access_* | timechart per_hour(eval(method="GET")) AS Views, per_hour(eval(action="purchase")) AS Purchases

Want to do something similar but need to timechart count for all the events to host=wap4* and to host=wap5*

Don't want a side by side chart...

Re: timechart dynamic fields

Ayn — Tue, 18 Feb 2014 06:20:18 GMT

If all you want to do is filter so that you only get events from those two hosts, just add those as search filters in your base search:

sourcetype=access_* host=wap4* host=wap5* | timechart per_hour(eval(method="GET")) AS Views, per_hour(eval(action="purchase")) AS Purchases

...assuming the destination host is in the "host" field. If it's in another field, just use that instead.

Re: timechart dynamic fields

jibiuthaman — Tue, 18 Feb 2014 16:44:01 GMT

I am not looking to filter but timechart count by host where host can 2 types... one which starts with wap4* and another that starts with wap3*...

Re: timechart dynamic fields

somesoni2 — Tue, 18 Feb 2014 17:24:33 GMT

Just add by host in the timechart.

Re: timechart dynamic fields

jibiuthaman — Tue, 18 Feb 2014 19:23:43 GMT

want to group wap4* as 1 type of host and wap3* as another type. Don't want individual time chart

Re: timechart dynamic fields

jibiuthaman — Thu, 20 Feb 2014 19:48:31 GMT

Any help on this one?
I am not looking to filter but timechart count by host where host can 2 types... one which starts with wap4 and another that starts with wap3...

Re: timechart dynamic fields

somesoni2 — Mon, 28 Sep 2020 15:56:49 GMT

Are you looking for something like this:-

sourcetype=access_* | timechart per_hour(eval(host="wap4")) AS wap4Count, per_hour(eval(host="wap5")) AS wap5Count

Re: timechart dynamic fields

jibiuthaman — Mon, 28 Sep 2020 15:56:54 GMT

close... but what i want to do is
sourcetype=access_* | timechart per_hour(eval(host="wap4*")) AS wap4Count, per_hour(eval(host="wap5*")) AS wap5Count

This doesn't work.

the below one was also close but then it also doesn't work with wild cards..

source=usgs | eval Description=case(depth<=70, "Shallow", depth>70 AND depth<=300, "Mid", depth>300, "Deep") | stats count min(mag) max(mag) by Description

Re: timechart dynamic fields

jibiuthaman — Thu, 20 Feb 2014 21:33:08 GMT

I hope you are able to see the * after wap4 and wap5

Re: timechart dynamic fields

somesoni2 — Mon, 28 Sep 2020 15:56:56 GMT

Try this

sourcetype=access_* | timechart per_hour(eval(LIKE(host,"wap4%"))) AS wap4Count, per_hour(eval(LIKE(host,"wap5%"))) AS wap5Count

Note that * is replaced by %

Re: timechart dynamic fields

jibiuthaman — Fri, 21 Feb 2014 01:32:31 GMT

Cool... it works!!!!

Re: timechart dynamic fields

somesoni2 — Fri, 21 Feb 2014 14:14:02 GMT

Great.. I have converted my comment as answer. Please accept the answer if there are no followup question.