Dashboards & Visualizations

What is the best command to make a line chart from regex?

Splunky21
Explorer

I created a custom regex to filter on a numeric value called "window size" which varies from positive to negative, and I want to display hosts by IP. Trying to figure out the best command (chart,stats) etc. I really want it to have hosts all on a line graph and their unique window sizes... 

I'm not sure if I have to use trellis to accomplish this, but I was hoping to make each line a host IP address and possibly have the x axis represent the window sizes available with the up/down spikes in window sizes being demonstrated.

I already have my two fields, just cant figure out how to display the data correctly in a visualization. NOTE: Whenever I do "chart count" this kind of gets in my way because count takes up a value and I really don't know how to format it... I need hosts to "dip up and down" with values 

 

Thanks in advance!

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Can you give an example of the data you are trying to visualise?

0 Karma

Splunky21
Explorer

Sure, I have 3 hosts currently (usually like 15). 

Event log looks like this:

Month date time:time:time IPaddress ProductName: [system] year value time:time:time value Product window average: 14.019745

This is pretty uniform throughout all logs, minus the fact the average varies. 

I did a regex to pull on the window average value as "WndwAvg" . 

I'm trying to display the WndwAvg (by host) as a line that's traveling across the graph so you can see when it goes in the negatives (drops alot) or goes up into the positives. Hoping there's a way to take the IP address (host) field and plot it by host. Just want to see all the ups and downs of averages visually. 

 

Hope this helps without getting too specific!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| timechart values(WndwAvg) by IPaddress
0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...