This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the same dataset that you will have already downloaded and ingested into Splunk. If not, please go to the Tutorial and complete it (or at least download and ingest the dataset).
This is the ninth blog in the series, and builds on the dashboard created in the previous blogs.
Having got the hourly rates from the events access log, you can now compare the last 24 hours to previous 24 hour periods using the timewrap command.
sourcetype=access_combined_wcookie
[| tstats min(_time) as earliest max(_time) as latest where sourcetype=access_combined_wcookie]
| timechart span=1h count by status
| addtotals row=t fieldname=total
| where total > 0
| eval success=round(100*'200'/total,2)
| timechart values(success) as success span=1h
| timewrap 24h
Note the addition of a subsearch to determine the earliest and latest times present in the data; this is because the timewrap command uses the latest time from the search timeframe to determine where to wrap back from. We use tstats here for speed and efficiency since we only need the _time field from the events.
Also note the table command has been replaced by a timechart command just before the timewrap command; this prevents a warning error message from appearing.This screen image shows the update success rate search with timewrap.
This screen image shows the success rate chart with timewrap.
This chart is very busy, so let's modify the search again to reduce the number of lines.
sourcetype=access_combined_wcookie
[| tstats min(_time) as earliest max(_time) as latest where sourcetype=access_combined_wcookie]
| timechart span=1h count by status
| addtotals row=t fieldname=total
| where total > 0
| eval success=round(100*'200'/total,2)
| timechart values(success) as success span=1h
| timewrap 24h
| untable _time day success
| appendpipe
[| stats min(success) as success by _time
| eval day="min_success"]
| appendpipe
[| stats max(success) as success by _time
| eval day="max_success"]
| where in(day, "min_success", "max_success", "success_latest_24hours")
| xyseries _time day success
| rename success_latest_24hours as success
Note the use of untable and xyseries to take the event pipeline out of chart layout and back again. The appendpipe commands process the event pipeline to provide minimum and maximum aggregations for each time bucket.This screen image shows the update success rate search with min and max hourly success rates.
This screen image shows the success rate chart with timewrap.
Now we have the lines we want, you can use a hidden feature of the line chart to enhance the visualization.
sourcetype=access_combined_wcookie
[| tstats min(_time) as earliest max(_time) as latest where sourcetype=access_combined_wcookie]
| timechart span=1h count by status
| addtotals row=t fieldname=total
| where total > 0
| eval success=round(100*'200'/total,2)
| timechart values(success) as success span=1h
| timewrap 24h
| untable _time day success
| appendpipe
[| stats min(success) as success by _time
| eval day="min_success"]
| appendpipe
[| stats max(success) as success by _time
| eval day="max_success"]
| where in(day, "min_success", "max_success", "success_latest_24hours")
| xyseries _time day success
| rename success_latest_24hours as success
| eval _lower="min_success"
| eval _upper="max_success"
| eval _predicted="success"
Note the use of _lower, _upper and _predicted hidden fields. These fields are recognised by the line chart visualization to modify how the chart is displayed and are also generated by the predict command.This screen image shows the update success rate search with _lower, _upper and _predicted field references.
This screen image shows the success rate chart with lower, upper and predicted lines.
All that remains is for you to format the chart so that useful information takes up more of the visualization real-estate.
| eventstats min(min_success) as _lowest_success
| eval _lowest_success=10*floor((_lowest_success-5)/10)
Note that the lower bound is rounded down to leave some space below the lowest value of success rate.
<done>
<set token="lowesty">$result._lowest_success$</set>
</done>
This screen image shows the done handler setting the lower y-axis bound token.
<option name="charting.axisY.maximumNumber">100</option>
<option name="charting.axisY.minimumNumber">$lowesty$</option>
This screen image shows the charting options setting the y-axis bounds.
<panel id="success_rate">
<title>Success rate compared to highest and lowest hourly rate</title>
<html depends="$alwaysHide$">
<style>
#success_rate .dashboard-panel
{
background-color: black !important;
text-align: center;
}
#success_rate h2.panel-title
{
color: white !important;
}
</style>
</html>
This screen image shows the success rate chart styling.
<option name="charting.axisTitleX.visibility">collapsed</option>
<option name="charting.axisTitleY.visibility">collapsed</option>
This screen image shows the success rate chart styling.
This final dashboard demonstrates a number of techniques which can be applied in other scenarios and usecases. Good luck applying them in your own dashboards.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.