topic Re: How do I display values over the last 24 hours? in Splunk Search

How do I display values over the last 24 hours?

loggeruk — Wed, 09 Sep 2015 15:47:35 GMT

Greetings,

I am trying to display the value of "002:emailsqu=33" over the last 24 hours and then graph it. The log comes in to the system every 180seconds

Date=Wednesday, September 9, 2015 3:10:37 PM
Location=ImageNowProduction
001:sizebundle=21
002:emailsqu=33
003:createdocumentqu=44

Many Thanks 🙂

Re: How do I display values over the last 24 hours?

frobinson_splun — Wed, 09 Sep 2015 16:23:56 GMT

Hi @loggeruk,
I'm a tech writer here at Splunk and I'd like to help. If I'm understanding your question, it sounds like you might want to run a query using a command like "timechart" to aggregate on the "002:emailsqu=33" field in your data , with the time picker set to "Last 24 hours". You can then set up a visualization, such as a line graph, to visualize the results.

Here are some resources that might help:
http://docs.splunk.com/Documentation/Splunk/6.2.5/SearchReference/Timechart
http://docs.splunk.com/Documentation/Splunk/6.2.5/SearchTutorial/Aboutthetimerangepicker
http://docs.splunk.com/Documentation/Splunk/6.2.5/Viz/ChartConfigurationReference#Area.2C_Bubble.2C_Bar.2C_Column.2C_Line.2C_and_Scatter_charts

I hope this helps! If not, let me know and we can keep discussing.

All the best,
@frobinson_splunk

Re: How do I display values over the last 24 hours?

aljohnson_splun — Wed, 09 Sep 2015 16:28:55 GMT

If emailsqu is already extracted as a field:

earliest=-24h sourcetype=foo emailsqu=* | table emailsqu _time

earliest=-24h sourcetype=foo  emailsqu=* | timechart span=2m max(emailsqu) as emailsqu

or you could use a different span and use avg instead of max for example.

If emailsqu is not extracted as a field:

   earliest=-24h sourcetype=foo | rex "emailsqu=(?<emailsqu>.*) | table emailsqu _time

   earliest=-24h sourcetype=foo | rex "emailsqu=(?<emailsqu>.*) | timechart span=2m max(emailsqu) as emailsqu

Re: How do I display values over the last 24 hours?

loggeruk — Mon, 21 Sep 2015 23:24:40 GMT

Thanks for the reply 🙂 see the attached screen shot i seem to be getting the data into the fields but i cant graph it for my dashboard

any ideas ?

Many thanks as always

Re: How do I display values over the last 24 hours?

MuS — Mon, 21 Sep 2015 23:38:44 GMT

try timechart instead of table

 .... | timechart values(textbehindocrdcg2) AS textbehindocrdcg2

cheers, MuS

Re: How do I display values over the last 24 hours?

loggeruk — Fri, 25 Sep 2015 22:12:41 GMT

I used the Pivot function with the MEDIAN option in the end, seems to be working well. Thanks for all the replies 🙂