Dashboards & Visualizations

How to plot multiple values on single line chart

shanecifaldi
Loves-to-Learn Everything

Hi All.

I run the below search

sourcetype=dbx3_netapp_vault_utilization

it returns the below: (names redacted)
alt text

I need to create a line chart that shows the "name" and "volumeUsed" from 48 hours ago compared to 24 hours ago so we can trend our snapshot size.

Tags (1)
0 Karma
1 Solution

horsefez
SplunkTrust
SplunkTrust

Hi @shanecifaldi,

how about something like this.

sourcetype=dbx3...zation earliest=-24h@h latest=@h | timechart span=1h sum(volumeUsed) AS volume_last_24h by name 
| append [search sourcetype=dbx3...zation earliest=-48h@h latest=-24h@h | timechart span=1h sum(volumeUsed) AS volume_last_48h by name] 

View solution in original post

0 Karma

horsefez
SplunkTrust
SplunkTrust

Hi @shanecifaldi,

how about something like this.

sourcetype=dbx3...zation earliest=-24h@h latest=@h | timechart span=1h sum(volumeUsed) AS volume_last_24h by name 
| append [search sourcetype=dbx3...zation earliest=-48h@h latest=-24h@h | timechart span=1h sum(volumeUsed) AS volume_last_48h by name] 
0 Karma

shanecifaldi
Loves-to-Learn Everything

this works well but there is one issue - for some reason almost 1/2 of the volumes are being grouped as "other".

0 Karma

shanecifaldi
Loves-to-Learn Everything

thanks for your help i figured it out with the limit=0 syntax.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...