Dashboards & Visualizations

What is the best command to make a line chart from regex?

Splunky21
Explorer

I created a custom regex to filter on a numeric value called "window size" which varies from positive to negative, and I want to display hosts by IP. Trying to figure out the best command (chart,stats) etc. I really want it to have hosts all on a line graph and their unique window sizes... 

I'm not sure if I have to use trellis to accomplish this, but I was hoping to make each line a host IP address and possibly have the x axis represent the window sizes available with the up/down spikes in window sizes being demonstrated.

I already have my two fields, just cant figure out how to display the data correctly in a visualization. NOTE: Whenever I do "chart count" this kind of gets in my way because count takes up a value and I really don't know how to format it... I need hosts to "dip up and down" with values 

 

Thanks in advance!

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Can you give an example of the data you are trying to visualise?

0 Karma

Splunky21
Explorer

Sure, I have 3 hosts currently (usually like 15). 

Event log looks like this:

Month date time:time:time IPaddress ProductName: [system] year value time:time:time value Product window average: 14.019745

This is pretty uniform throughout all logs, minus the fact the average varies. 

I did a regex to pull on the window average value as "WndwAvg" . 

I'm trying to display the WndwAvg (by host) as a line that's traveling across the graph so you can see when it goes in the negatives (drops alot) or goes up into the positives. Hoping there's a way to take the IP address (host) field and plot it by host. Just want to see all the ups and downs of averages visually. 

 

Hope this helps without getting too specific!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| timechart values(WndwAvg) by IPaddress
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...