Reporting

how to pass time span in datamodel

sumitnagal
Path Finder

We have few data model, but we are not able to pass the span / PERIOD other then default values. this is creating problem as we are not able to put different bucket options (1m, 10 m, 1 h ...) and our chart data is exceeding more then 1000 points. here is simple data model query

| pivot DataModel_ABC perf count(TPS) AS "tps" sum(execTime) AS "execTime" SPLITROW _time AS _time PERIOD auto SPLITROW host AS hostname

Please let me know

Tags (1)
1 Solution

jayannah
Builder

Hi, Today I was working on similar requirement.. so here is example how you can use accelerated datamodel and create timechart with custom timespan using tstats command. You can't pass custome time span in Pivot.

index=abc earliest=01/08/2015:11:00:00 latest=01/08/2015:11:12:00 | timechart span=2m count

The equivalent is using tstats is
| tstats count where earliest=01/08/2015:11:00:00 latest=01/08/2015:11:12:00 index=abc groupby _time span=1m

For you requirement with datamodel name DataModel_ABC, use the below command

| tstats count from datamodel=DataModel_ABC where earliest=01/08/2015:11:00:00 latest=01/08/2015:11:12:00 groupby _time span=2m

Hope this will help all splunkers and you too.

View solution in original post

sumitnagal
Path Finder

This works with some workaround on data model , here is new query

| tstats sum(ABC.time) as time FROM datamodel=DataModel_ABC groupby ABC.id,_time|| timechart avg(time) as time by id

however, I was using post processing in my dashboard. so now I have to write one direct query in dashboard.
second avg time value I am not able to round up, as after this search round function is not working, may be I am missing something
eval time=round(time,2)
third, I am plotting TPS, but using this model and printing below query doesn't give right information on data model.
| eval count=1 | timechart per_second(count)

0 Karma

jayannah
Builder

Hi, Today I was working on similar requirement.. so here is example how you can use accelerated datamodel and create timechart with custom timespan using tstats command. You can't pass custome time span in Pivot.

index=abc earliest=01/08/2015:11:00:00 latest=01/08/2015:11:12:00 | timechart span=2m count

The equivalent is using tstats is
| tstats count where earliest=01/08/2015:11:00:00 latest=01/08/2015:11:12:00 index=abc groupby _time span=1m

For you requirement with datamodel name DataModel_ABC, use the below command

| tstats count from datamodel=DataModel_ABC where earliest=01/08/2015:11:00:00 latest=01/08/2015:11:12:00 groupby _time span=2m

Hope this will help all splunkers and you too.

wangweibee
Explorer

I have the same problem, and hope to get a solution.

0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...