Dashboards & Visualizations

What is the best command to make a line chart from regex?

Splunky21
Explorer

I created a custom regex to filter on a numeric value called "window size" which varies from positive to negative, and I want to display hosts by IP. Trying to figure out the best command (chart,stats) etc. I really want it to have hosts all on a line graph and their unique window sizes... 

I'm not sure if I have to use trellis to accomplish this, but I was hoping to make each line a host IP address and possibly have the x axis represent the window sizes available with the up/down spikes in window sizes being demonstrated.

I already have my two fields, just cant figure out how to display the data correctly in a visualization. NOTE: Whenever I do "chart count" this kind of gets in my way because count takes up a value and I really don't know how to format it... I need hosts to "dip up and down" with values 

 

Thanks in advance!

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Can you give an example of the data you are trying to visualise?

0 Karma

Splunky21
Explorer

Sure, I have 3 hosts currently (usually like 15). 

Event log looks like this:

Month date time:time:time IPaddress ProductName: [system] year value time:time:time value Product window average: 14.019745

This is pretty uniform throughout all logs, minus the fact the average varies. 

I did a regex to pull on the window average value as "WndwAvg" . 

I'm trying to display the WndwAvg (by host) as a line that's traveling across the graph so you can see when it goes in the negatives (drops alot) or goes up into the positives. Hoping there's a way to take the IP address (host) field and plot it by host. Just want to see all the ups and downs of averages visually. 

 

Hope this helps without getting too specific!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| timechart values(WndwAvg) by IPaddress
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...