How to chart multiple events greater and less than a field's value?

[dwillsonnz]

I'm trying to get a chart that displays the number of events where ProcessingTime was less than 1 second, between 1 and 2 seconds, and greater than 2 seconds within a certain time frame, and displaying that as 3 separate lines on a chart.

I can search for these stats individually:

search command ProcessingTime<1  | timechart span=10s count by _count 
search command ProcessingTime>1 ProcessingTime<2  | timechart span=10s count by _count 
etc

But what I want is multiple lines in one chart depending on which "bucket" the field value falls into. Unfortunately I'm not sure what I should be searching for to find what I want to do. Any tips?

[niketn]

While I would also use eval within transforming command, just throwing in the union command as another option which should work on Splunk 6.6 or higher.

PS: It will run on Search Head if the data sets of both sub-searches are non-streaming (in the following example because of timechart).

| union 
    [ search index=_internal sourcetype=splunkd log_level=ERROR 
    | timechart count as Error] 
    [ search index=_internal sourcetype=splunkd log_level=WARN 
    | timechart count as WARN]

[renjith_nair · Accepted solution]

Hi @dwillsonnz ,

Try

"search command" 
|timechart span=10s count(eval(if(ProcessingTime<1,ProcessingTime,null()))) as less_than_one,count(eval(if(ProcessingTime>1 AND ProcessingTime<2,ProcessingTime,null()))) as between_one_two ,count(eval(if(ProcessingTime>2,ProcessingTime,null()))) as above_two by _count

Reference : http://docs.splunk.com/Documentation/Splunk/7.1.2/Search/Usestatswithevalexpressionsandfunctions

[dwillsonnz]

This worked for me, and I had an easy time expanding this into a wider number of brackets as well, even if I don't fully understand the syntax yet! Thanks!

[renjith_nair]

@dwillsonnz , will try to breakdown the commands

1 . count() -- normal count
2 . count( eval() ) -- evaluate whats inside the bracket (similart to if)
3. count( eval( your condition ) ) => count(eval(range=="<1"))

So it evaluates the condition and its true, takes the first value, if not takes the second value which is null() in our case - in other words if the condition does not match, it does not consider any value

[niketn]

@renjith.nair, as per the original question, I would add ProcessingTime<2 as filter in the base search and not use count(eval(if(ProcessingTime>2,ProcessingTime,null()))) as above_two by _count.

We can also use

<baseSearchFilters> ProcessingTime<2
| eval range=case(ProcessingTime<1,"<1",ProcessingTime>=1 AND ProcessingTime<2,">1 & <2")
| timechart span=10s count(eval(range=="<1")) as "<1" count(eval(range==">1 & <2")) as ">1 & <2" by _count

Both the query might have to be tested for performance as Built-in search optimization may change the resultant query being run which does processing to the same effect. Also depends on actual infrastructure i.e. whether indexers can handle more load or search heads. Refer to answer: https://answers.splunk.com/answers/661195/query-performance-question-using-pipe-vs-inline-fu.html

[renjith_nair]

@niketnilay, thanks for the hint, but i think he wants the result for >2 as well as per the question though only 2 are mentioned in SPL I'm trying to get a chart that displays the number of events where ProcessingTime was less than 1 second, between 1 and 2 seconds, and greater than 2 seconds within a certain time frame, and displaying that as 3 separate lines on a chart.

[niketn]

@renjith.nair sorry I missed that in the question 🙂