Dashboards & Visualizations

How to display my data in a graph over time?

schu777
Explorer

I have the following line that is getting logged - it has totals for several queues in an app. I'd like to have a graph to show the totals as time goes - how can I accomplish this in Splunk? (Sorry, I'm very new to this part of Splunk) Note - these message are done every 5 minutes for development.

Thanks, Michael

Feb 27, 2015 11:14:39  totalOutAckCount=153 totalOutEnqCount=216 totalEnqueuedCount=0 totalErrorCount=123 totalErrorCount=2281
Tags (2)
0 Karma
1 Solution

cpetterborg
SplunkTrust
SplunkTrust

Try the following:

<yoursearch> | timechart span=5m last(totalOutAckCount) last(totalOutEnqCount) last(totalEnqueuedCount) last(totalErrorCount) last(totalErrorCount)

If your data is coming out with the key/value fields properly, this should work. If not, then a rex command will help, just reply about it here and we can come up with a rex that will work.

Be sure to look at the visualization tab for the actual graph.

View solution in original post

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

Try the following:

<yoursearch> | timechart span=5m last(totalOutAckCount) last(totalOutEnqCount) last(totalEnqueuedCount) last(totalErrorCount) last(totalErrorCount)

If your data is coming out with the key/value fields properly, this should work. If not, then a rex command will help, just reply about it here and we can come up with a rex that will work.

Be sure to look at the visualization tab for the actual graph.

0 Karma

schu777
Explorer

I tried that above, but didn't work. Here is lines that I have. NOTE that each is a total of a queue for the application. I'd like to get a graph of each total. I'll play around with it and hopefully I can get something. I know having a count of what was processed would make thing easier in Splunk, but this is the first cut of splunk logging for this application.

    Mar 06, 2015 19:02:59  totalOutAckCrsCount=212 totalOutEnqCrsCount=301 totalEnqueuedPmsCount=0 totalErrorCrsCount=153 totalErrorPmsCount=1018
    Mar 06, 2015 18:57:59  totalOutAckCrsCount=212 totalOutEnqCrsCount=301 totalEnqueuedPmsCount=0 totalErrorCrsCount=153 totalErrorPmsCount=1018
    Mar 06, 2015 18:52:59  totalOutAckCrsCount=212 totalOutEnqCrsCount=301 totalEnqueuedPmsCount=0 totalErrorCrsCount=153 totalErrorPmsCount=1018
0 Karma

schu777
Explorer

Well, I figured it out - I messed up on the names - the last post is the actual names - now it works! Now to put into a Dashboard for development, then once this goes out, production Dashboard!

THANKS!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...