Dashboards & Visualizations

Graphing off Tstats - total mental block

aymonfoa
Engager

Got a search like this (I've obfuscated it a bit)

| tstats count where index IN (index1, index2, index3) by _time , host
| where match(host,"^.*.device.mycompany.com$")

Got a great looking stats table - and Im really pleased with the performance of tstats - awesome.

I want to graph the results... easy right?  well no - I cannot for the life of me seem to break down a say, 60 minute span down by host, despite the fact I got this awesome oven ready totally graphable stats table

so I am trying 

| tstats count where index IN (index1, index2, index3) by _time , host
| where match(host,"^.*.device.mycompany.com$")
| timechart count by host

but the count is counting the host, whereas I want to "count the count" ?  Any ideas?  this will be a super simple one I expect - I got a total mental block on this

Labels (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

You can either use the prestats option as @richgalloway suggests, or the alternative way is to use count in tstats, then sum(count) in timechart, i.e.

| tstats count where index IN (index1, index2, index3) by _time , host
| where match(host,"^.*.device.mycompany.com$")
| timechart sum(count) by host

 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

You can either use the prestats option as @richgalloway suggests, or the alternative way is to use count in tstats, then sum(count) in timechart, i.e.

| tstats count where index IN (index1, index2, index3) by _time , host
| where match(host,"^.*.device.mycompany.com$")
| timechart sum(count) by host

 

richgalloway
SplunkTrust
SplunkTrust

Add the prestats option to the tstats command.  That will format the results for timechart to use.

| tstats prestats=t count where index IN (index1, index2, index3) by _time , host
| where match(host,"^.*.device.mycompany.com$")
| timechart count by host

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...