Dashboards & Visualizations

What is the best command to make a line chart from regex?

Splunky21
Explorer

I created a custom regex to filter on a numeric value called "window size" which varies from positive to negative, and I want to display hosts by IP. Trying to figure out the best command (chart,stats) etc. I really want it to have hosts all on a line graph and their unique window sizes... 

I'm not sure if I have to use trellis to accomplish this, but I was hoping to make each line a host IP address and possibly have the x axis represent the window sizes available with the up/down spikes in window sizes being demonstrated.

I already have my two fields, just cant figure out how to display the data correctly in a visualization. NOTE: Whenever I do "chart count" this kind of gets in my way because count takes up a value and I really don't know how to format it... I need hosts to "dip up and down" with values 

 

Thanks in advance!

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Can you give an example of the data you are trying to visualise?

0 Karma

Splunky21
Explorer

Sure, I have 3 hosts currently (usually like 15). 

Event log looks like this:

Month date time:time:time IPaddress ProductName: [system] year value time:time:time value Product window average: 14.019745

This is pretty uniform throughout all logs, minus the fact the average varies. 

I did a regex to pull on the window average value as "WndwAvg" . 

I'm trying to display the WndwAvg (by host) as a line that's traveling across the graph so you can see when it goes in the negatives (drops alot) or goes up into the positives. Hoping there's a way to take the IP address (host) field and plot it by host. Just want to see all the ups and downs of averages visually. 

 

Hope this helps without getting too specific!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| timechart values(WndwAvg) by IPaddress
0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...