All Apps and Add-ons

Graph the Highest hits in a 5 minute interval per day split by a field

yechoorv
Explorer

I want to create a graph that graphs the hits of the 5 minute interval with the maximum hits on that day. I also want to split this up by a field called MethodName:

Something like

source:__ | timechart count as hits span=5m | timechart max(hits)

That is the graph I need, but I need to split this by the field: "MethodName"

Any suggestions?

Tags (3)
1 Solution

dwaddle
SplunkTrust
SplunkTrust

Here's an approach that looks like it should work, using Splunk's internal data as an example:

index=_internal 
| bucket span=1m _time 
| stats count by _time,source 
| timechart span=1d max(count) by source

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

Here's an approach that looks like it should work, using Splunk's internal data as an example:

index=_internal 
| bucket span=1m _time 
| stats count by _time,source 
| timechart span=1d max(count) by source

yechoorv
Explorer

Worked perfectly thanks!

Get Updates on the Splunk Community!

Get Schooled with Splunk Education: Explore Our Latest Courses

At Splunk Education, we’re dedicated to providing incredible learning experiences that cater to every skill ...

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL  The Splunk AI Assistant for SPL ...

Buttercup Games: Further Dashboarding Techniques (Part 5)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...