Archive

How to make a visualization with time?

Communicator

I have a base query that returns the field transferspeed . And the transferspeed changes (keeps on changing). Sometimes it has a low value like 2 and sometimes as 150 (in kbps).

| basequery
| table transfer_speed

I want to be able to see the transferspeed in a graph/line chart / or any such way having x asis showing time and y axis as speed.
Also is it possible to see the "rate of change" of transfer
speed at any particular point in the graph ?

Tags (1)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

well you can try something like this

| basequery 
| timechart span=1h avg(transfer_speed) as transfer_speed | delta transfer_speed as "rate of change"

you can change the span as per your need.
let me know if this helps!

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

well you can try something like this

| basequery 
| timechart span=1h avg(transfer_speed) as transfer_speed | delta transfer_speed as "rate of change"

you can change the span as per your need.
let me know if this helps!

View solution in original post

0 Karma

Communicator

It won't give any value. adding that last line is not giving any value.
Nothing comes in the visualization and in the statistics tab also under avg(transfer_speed) it shows nothing.

This is what I tried
| base query
| table transferspeed
| timechart span=1h avg(transfer
speed)

It shows me transfer_speed when I give |table command. But nothing comes when I add the timechart command

0 Karma

SplunkTrust
SplunkTrust

Yes but obviously it will not give any value because of | table transfer_speed .

just try this

| base query
| timechart span=1h avg(transfer_speed) as transfer_speed | delta transfer_speed as "rate of change"

Remove | table transfer_speed from your query and try.

let me know if this helps!

0 Karma

Communicator

This helps. Thank you. The 'Delta' thing is what I was looking for. Thanks again.

0 Karma