topic Re: grouped graphing over time in Splunk Search

grouped graphing over time

mariof — Mon, 28 Sep 2020 15:30:04 GMT

Hi,
I have a csv file which contains the following information:
Date,Pool,DiskType,RaidType,Description,UserCapacity,ConsumedCapacity,AvailableCapacity,SubscribedCapacity,OverSubscribedBy,PercentFull,PercentSubscribed
Thu Dec 12 15:09:59 GMT 2013,Pool 20,Mixed,r_10,Tier 0/1 - 15K + EFD/SSD pool for Citrix,8885.320,6230.145,2655.176,7369.365,0.000,70.117,82.939
Thu Dec 12 15:09:59 GMT 2013,Pool 10,Mixed,r_5,Tier 1/3 - 15K + 7.2K pool for shared storage - pool closed reach max IOPS,36094.359,27367.348,8727.012,38937.902,2843.543,75.822,107.878
Thu Dec 12 15:09:59 GMT 2013,Pool 11,Mixed,r_5,Tier 1/3 - 15K + 7.5K pool for sharded storage,36094.359,28398.357,7696.002,47333.268,11238.908,78.678,131.138
...
Fri Dec 13 10:20:48 GMT 2013,Pool 19,SAS,r_5,Tier 1 Pool - Pool Closed 09/11/2012 MH,25718.133,21334.588,4383.545,29838.164,4120.031,82.955,116.020
Fri Dec 13 10:20:48 GMT 2013,Pool 13,Mixed,r_5,Tier 0/1 - 15K + EFD/SSD pool for shared storage - 130% over,22162.201,17873.842,4288.359,24064.910,1902.709,80.650,108.585
Fri Dec 13 10:20:48 GMT 2013,Pool 21,Mixed,r_10,Tier 0/1 - 15K + EFD/SSD pool,8885.320,4965.680,3919.641,5361.451,0.000,55.886,60.341
Fri Dec 13 10:20:48 GMT 2013,Pool 18,SAS,r_10,Tier 1 - 15K pool for sharded storage - RAID 10,2131.154,1356.645,774.510,2517.908,386.754,63.658,118.148
Fri Dec 13 10:20:48 GMT 2013,Pool 15,Mixed,r_5,Tier 3/4 - 10K + 7.2K pool for sharded storage,36094.359,27272.162,8822.197,37163.443,1069.084,75.558,102.962
Fri Dec 13 10:20:48 GMT 2013,Pool 22,SAS,r_10,Tier 1 - 15K pool for shared storage,2131.154,294.574,1836.580,294.574,0.000,13.822,13.822

I have been able to extract the various data types into fields quite easily, but I'm hoping to produce a bar chart over time for each storage pool, so that I can show how things are changing for each pool. Is this possible?

Re: grouped graphing over time

dart — Tue, 17 Dec 2013 10:46:10 GMT

You should be able to with a search like this:

sourcetype=my_sourcetype | timechart min(AvailableCapacity) by Pool

Assuming you called the fields the same names as your header.

Re: grouped graphing over time

mariof — Mon, 28 Sep 2020 15:30:06 GMT

Hi,
I was actually testing, using:
index=storage | chart max(storage_cap_consumed) max(storage_cap_avail) by storage_pool
but i only get one value.

I'd like to get all the values of storage_cap_consumed of each pool over time.

Re: grouped graphing over time

dart — Mon, 28 Sep 2020 15:30:10 GMT

Does this one work:
index=storage | timechart max(storage_cap_consumed) by storage_pool

Re: grouped graphing over time

mariof — Mon, 28 Sep 2020 15:30:12 GMT

Hi Dart,
thanks for your help.
i think i have done it by using:
index=storage | chart max(storage_cap_consumed) max(storage_cap_avail) by storage_pool,_time

i just need to change _time to something nicer