topic Re: How to do timechart on a field that has same name but different alert level? in Splunk Search

How to do timechart on a field that has same name but different alert level?

wuming79 — Tue, 29 Sep 2020 15:04:22 GMT

Hi,

I have a log with a field call "Event_Types" and then another field call "Alert Level" .
In my logs there is an event call "Ping" but this "Ping" has 2 Alert Levels 6 and 10.
I want to do a timechart on Event_Types but also want to show that there are 2 pings with different alert levels counted over time. How should I search for it?

Alert_Level > 6 | timechart count(Event_Types) as Event_Types count(Alert_Level) will show "The argument 'count(Alert_Level)' is invalid."

Re: How to do timechart on a field that has same name but different alert level?

niketn — Fri, 28 Jul 2017 09:31:59 GMT

Are you trying a query like the following?

| where Alert_Level > 6 | timechart count(Event_Types) as Event_Types count(Alert_Level) as Alert_Level

Re: How to do timechart on a field that has same name but different alert level?

wuming79 — Tue, 29 Sep 2020 15:09:23 GMT

Hi sorry, I made a mistake, I need it to display "|Alert_Level > 6 | timechart count(Event_Types) by Event_Types count(Alert_Level) "

Re: How to do timechart on a field that has same name but different alert level?

somesoni2 — Fri, 28 Jul 2017 16:41:11 GMT

Give this a try
Updated: Fixed typo with field name

your base search | eval EventType=Event_Types.":".Alert_Level | timechart count by EventType

your base search  | where Alert_Level > 6 | eval EventType=Event_Types.":".Alert_Level | timechart count by EventType

Re: How to do timechart on a field that has same name but different alert level?

wuming79 — Fri, 28 Jul 2017 17:23:22 GMT

Hi somesoni2,

the search show all NULL.

Re: How to do timechart on a field that has same name but different alert level?

niketn — Tue, 29 Sep 2020 15:06:19 GMT

@somesoni2, I think field name is Event_Types and not Event_Type.
@wuming79, can you please confirm the field names Event_Types and Alert_Level?

Re: How to do timechart on a field that has same name but different alert level?

somesoni2 — Fri, 28 Jul 2017 18:51:28 GMT

@wuming79, there was a typo in my original answer (thanks @niketnilay for pointing that one out), which may be causing that NULL column name. Try the updated answer.

Re: How to do timechart on a field that has same name but different alert level?

wuming79 — Sun, 30 Jul 2017 13:37:35 GMT

Hi, it's working now. Thanks! 🙂