Dashboards & Visualizations

How to chart multiple events greater and less than a field's value?

New Member

I'm trying to get a chart that displays the number of events where ProcessingTime was less than 1 second, between 1 and 2 seconds, and greater than 2 seconds within a certain time frame, and displaying that as 3 separate lines on a chart.

I can search for these stats individually:

search command ProcessingTime<1  | timechart span=10s count by _count 
search command ProcessingTime>1 ProcessingTime<2  | timechart span=10s count by _count 
etc

But what I want is multiple lines in one chart depending on which "bucket" the field value falls into. Unfortunately I'm not sure what I should be searching for to find what I want to do. Any tips?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Hi @dwillsonnz ,

Try

"search command" 
|timechart span=10s count(eval(if(ProcessingTime<1,ProcessingTime,null()))) as less_than_one,count(eval(if(ProcessingTime>1 AND ProcessingTime<2,ProcessingTime,null()))) as between_one_two ,count(eval(if(ProcessingTime>2,ProcessingTime,null()))) as above_two by _count

Reference : http://docs.splunk.com/Documentation/Splunk/7.1.2/Search/Usestatswithevalexpressionsandfunctions

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

While I would also use eval within transforming command, just throwing in the union command as another option which should work on Splunk 6.6 or higher.

PS: It will run on Search Head if the data sets of both sub-searches are non-streaming (in the following example because of timechart).

| union 
    [ search index=_internal sourcetype=splunkd log_level=ERROR 
    | timechart count as Error] 
    [ search index=_internal sourcetype=splunkd log_level=WARN 
    | timechart count as WARN]
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

SplunkTrust
SplunkTrust

Hi @dwillsonnz ,

Try

"search command" 
|timechart span=10s count(eval(if(ProcessingTime<1,ProcessingTime,null()))) as less_than_one,count(eval(if(ProcessingTime>1 AND ProcessingTime<2,ProcessingTime,null()))) as between_one_two ,count(eval(if(ProcessingTime>2,ProcessingTime,null()))) as above_two by _count

Reference : http://docs.splunk.com/Documentation/Splunk/7.1.2/Search/Usestatswithevalexpressionsandfunctions

View solution in original post

0 Karma

New Member

This worked for me, and I had an easy time expanding this into a wider number of brackets as well, even if I don't fully understand the syntax yet! Thanks!

0 Karma

SplunkTrust
SplunkTrust

@dwillsonnz , will try to breakdown the commands

1 . count() -- normal count
2 . count( eval() ) -- evaluate whats inside the bracket (similart to if)
3. count( eval( your condition ) ) => count(eval(range=="<1"))

So it evaluates the condition and its true, takes the first value, if not takes the second value which is null() in our case - in other words if the condition does not match, it does not consider any value

0 Karma

SplunkTrust
SplunkTrust

@renjith.nair, as per the original question, I would add ProcessingTime<2 as filter in the base search and not use count(eval(if(ProcessingTime>2,ProcessingTime,null()))) as above_two by _count.

We can also use

<baseSearchFilters> ProcessingTime<2
| eval range=case(ProcessingTime<1,"<1",ProcessingTime>=1 AND ProcessingTime<2,">1 & <2")
| timechart span=10s count(eval(range=="<1")) as "<1" count(eval(range==">1 & <2")) as ">1 & <2" by _count

Both the query might have to be tested for performance as Built-in search optimization may change the resultant query being run which does processing to the same effect. Also depends on actual infrastructure i.e. whether indexers can handle more load or search heads. Refer to answer: https://answers.splunk.com/answers/661195/query-performance-question-using-pipe-vs-inline-fu.html

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

SplunkTrust
SplunkTrust

@niketnilay, thanks for the hint, but i think he wants the result for >2 as well as per the question though only 2 are mentioned in SPL I'm trying to get a chart that displays the number of events where ProcessingTime was less than 1 second, between 1 and 2 seconds, and greater than 2 seconds within a certain time frame, and displaying that as 3 separate lines on a chart.

0 Karma

SplunkTrust
SplunkTrust

@renjith.nair sorry I missed that in the question 🙂

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma