Archive

How to chart field1 by field2 and overlay by aggregate

Explorer

I have two fields
field1 as response time
field 2 as instance name

I want to plot the response time by instance name and overlay the average response time of a single instance name.

Data is like
Instance1 responsetime1
Instance1 responsetime2
:
Instance1 responsetimeN
Instance2 responsetime1
Instance2 responsetime2
:
Instance2 responsetimeN
:
and so on.

So I want chart of responsetime by instance name and an overlay line of avg(responsetime) of only single instance say instance5

Can you please help.

Tags (1)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

HI KabSplunk,

Please try the following:

  1. Run the following search:

    sourcetye= | chart count, sum(responsetime) AS total_responsetime by instance | eval avg_responsetime = total_responsetime/count

  2. After you get the statistics, go to Visualization.

  3. Select Column Chart.

  4. Click Format and select ** Chart Overlay**.

  5. In the Overlay field, type avg_responsetime.

You should see total_responsetime as columns on the y axis overlayed by the avg_bytes values. Instances are on the x axis.

Hope it helps. Thanks!
Hunter

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

HI KabSplunk,

Please try the following:

  1. Run the following search:

    sourcetye= | chart count, sum(responsetime) AS total_responsetime by instance | eval avg_responsetime = total_responsetime/count

  2. After you get the statistics, go to Visualization.

  3. Select Column Chart.

  4. Click Format and select ** Chart Overlay**.

  5. In the Overlay field, type avg_responsetime.

You should see total_responsetime as columns on the y axis overlayed by the avg_bytes values. Instances are on the x axis.

Hope it helps. Thanks!
Hunter

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

The search string was not correctly displayed; should be:

sourcetye= my_sourcetype | chart count, sum(responsetime) AS total_responsetime by instance | eval avg_responsetime = total_responsetime/count

0 Karma

Explorer

Thanks. I had got it fixed

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!