Dashboards & Visualizations

Timechart with added series

michaelmathis
Engager

I have some records that show interface utilization across multiple devices.  I would like to add the utilization from two different devices so that two series are presented on my timechart, summary of inbound utilization for devices A + B, and summary of outbound utilization for devices A+B.


index=nnmperf "Interface Name"="Te0/1/0" "Node Name"="A" OR "Node Name"="B"
| rename "Utilization In" as In
| rename "Utilization Out" as Out
| eval In=In*100
| eval Out=Out*100
| timechart span=30m avg(In) avg(Out) by "Node Name"

I've tried to pipe the chart to addTotals, but I can't figure out how to split the total into two series one for inbound and one for outbound. 

Could someone help me out?  Thank you!

 

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| gentimes start=-1 increment=10s 
| eval node=mvindex(split("AB",""),random()%2)
| eval in=random()%100
| eval out=random()%100
| rename starttime as _time 
| table _time node in out


| timechart span=30m avg(in) avg(out) by node
| eval "total: A"='avg(in): A'+'avg(out): A'
| eval "total: B"='avg(in): B'+'avg(out): B'

View solution in original post

0 Karma

michaelmathis
Engager

Thank you for your help!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| gentimes start=-1 increment=10s 
| eval node=mvindex(split("AB",""),random()%2)
| eval in=random()%100
| eval out=random()%100
| rename starttime as _time 
| table _time node in out


| timechart span=30m avg(in) avg(out) by node
| eval "total: A"='avg(in): A'+'avg(out): A'
| eval "total: B"='avg(in): B'+'avg(out): B'
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...