Dashboards & Visualizations

How do I graph aggregated data points?

jerry_jeremiah
New Member

Hello,

Having replaced the existing system with Splunk I have a question about how to replicate a particular type of graph. The logs are being parsed and I can do simple searches and dashboards but I don't have access to the server - all I can do is make searches and dashboards. What I want is a graph that has data points every five minutes and each point is the average of the previous 15 minute period.

So, the log contains a numeric value and on the graph the rightmost data point is the average of the last 15 minute period and the data point immediately to its left is the average of the 15 minutes ending 5 minutes ago and the data point immediately to its left is the average of the 15 minutes ending 10 minutes ago.

How can I do that?

Thanks!

Tags (2)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi jerry_jeremiah,

take this run everywhere example, which counts the events and average of the field kbps over five minutes, next the streamstats will aggregate the timechart results over 15 minutes (using the window=3 argument) and returns the average count and average kbps over the last 15 minutes in a time related chart:

index=_internal earliest=-2h@h 
| timechart span=5m count, avg(kbps) as avg_kbps 
| streamstats window=3 avg(count) as avg_count, avg(avg_kbps) as avg_kbps

adapt this search and use the Visualization and the format to display the graph in a way that fits your needs.

hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi jerry_jeremiah,

take this run everywhere example, which counts the events and average of the field kbps over five minutes, next the streamstats will aggregate the timechart results over 15 minutes (using the window=3 argument) and returns the average count and average kbps over the last 15 minutes in a time related chart:

index=_internal earliest=-2h@h 
| timechart span=5m count, avg(kbps) as avg_kbps 
| streamstats window=3 avg(count) as avg_count, avg(avg_kbps) as avg_kbps

adapt this search and use the Visualization and the format to display the graph in a way that fits your needs.

hope this helps ...

cheers, MuS

View solution in original post

jerry_jeremiah
New Member

That works great! In the end I aggregate the sum and count and then divide at the end with an eval because the average of three averages isn't a real average. Thanks so much for the help.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!