Dashboards & Visualizations

Timechart with added series

michaelmathis
Engager

I have some records that show interface utilization across multiple devices.  I would like to add the utilization from two different devices so that two series are presented on my timechart, summary of inbound utilization for devices A + B, and summary of outbound utilization for devices A+B.


index=nnmperf "Interface Name"="Te0/1/0" "Node Name"="A" OR "Node Name"="B"
| rename "Utilization In" as In
| rename "Utilization Out" as Out
| eval In=In*100
| eval Out=Out*100
| timechart span=30m avg(In) avg(Out) by "Node Name"

I've tried to pipe the chart to addTotals, but I can't figure out how to split the total into two series one for inbound and one for outbound. 

Could someone help me out?  Thank you!

 

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| gentimes start=-1 increment=10s 
| eval node=mvindex(split("AB",""),random()%2)
| eval in=random()%100
| eval out=random()%100
| rename starttime as _time 
| table _time node in out


| timechart span=30m avg(in) avg(out) by node
| eval "total: A"='avg(in): A'+'avg(out): A'
| eval "total: B"='avg(in): B'+'avg(out): B'

View solution in original post

0 Karma

michaelmathis
Engager

Thank you for your help!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| gentimes start=-1 increment=10s 
| eval node=mvindex(split("AB",""),random()%2)
| eval in=random()%100
| eval out=random()%100
| rename starttime as _time 
| table _time node in out


| timechart span=30m avg(in) avg(out) by node
| eval "total: A"='avg(in): A'+'avg(out): A'
| eval "total: B"='avg(in): B'+'avg(out): B'
0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...