Dashboards & Visualizations

Graphing off Tstats - total mental block

aymonfoa
Engager

Got a search like this (I've obfuscated it a bit)

| tstats count where index IN (index1, index2, index3) by _time , host
| where match(host,"^.*.device.mycompany.com$")

Got a great looking stats table - and Im really pleased with the performance of tstats - awesome.

I want to graph the results... easy right?  well no - I cannot for the life of me seem to break down a say, 60 minute span down by host, despite the fact I got this awesome oven ready totally graphable stats table

so I am trying 

| tstats count where index IN (index1, index2, index3) by _time , host
| where match(host,"^.*.device.mycompany.com$")
| timechart count by host

but the count is counting the host, whereas I want to "count the count" ?  Any ideas?  this will be a super simple one I expect - I got a total mental block on this

Labels (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

You can either use the prestats option as @richgalloway suggests, or the alternative way is to use count in tstats, then sum(count) in timechart, i.e.

| tstats count where index IN (index1, index2, index3) by _time , host
| where match(host,"^.*.device.mycompany.com$")
| timechart sum(count) by host

 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

You can either use the prestats option as @richgalloway suggests, or the alternative way is to use count in tstats, then sum(count) in timechart, i.e.

| tstats count where index IN (index1, index2, index3) by _time , host
| where match(host,"^.*.device.mycompany.com$")
| timechart sum(count) by host

 

richgalloway
SplunkTrust
SplunkTrust

Add the prestats option to the tstats command.  That will format the results for timechart to use.

| tstats prestats=t count where index IN (index1, index2, index3) by _time , host
| where match(host,"^.*.device.mycompany.com$")
| timechart count by host

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...