Alerting

Creating per-server report

neil_craig
Engager

Hello all

I'm trying to create a report in Splunk (4.3.4). I can get the fields i want into a table but can't format a graph in the way i would like, this is what i'd really appreciate help with.

So i am ending up with 3 fields:
datetime (e.g. "2012-12-11 09:01:02")
serverName (e.g. "clientRef-host1")
numErrors (e.g. 1234)

What i would like is to have a line chart (although another type is fine if it displays the information logically) which shows:
x axis: datetime
y axis: numErrors
Lines: one line per serverName

If anyone can offer advice on how to achieve this, i'd be very grateful - i though it would be simple but it's eluded me thus far!

Many thanks
Neil

Tags (1)
0 Karma

lguinn2
Legend

Here's one idea:

... | timechart span=1h sum(numErrors) as ErrorCount by serverName 

This will show one line for each server. Each point on the line will represent one hour of errors.

If you want more suggestions, we need a little more information, like - how did you get the three fields? What does the source look like?

HTH!

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...