Reporting

how to pass time span in datamodel

sumitnagal
Path Finder

We have few data model, but we are not able to pass the span / PERIOD other then default values. this is creating problem as we are not able to put different bucket options (1m, 10 m, 1 h ...) and our chart data is exceeding more then 1000 points. here is simple data model query

| pivot DataModel_ABC perf count(TPS) AS "tps" sum(execTime) AS "execTime" SPLITROW _time AS _time PERIOD auto SPLITROW host AS hostname

Please let me know

Tags (1)
1 Solution

jayannah
Builder

Hi, Today I was working on similar requirement.. so here is example how you can use accelerated datamodel and create timechart with custom timespan using tstats command. You can't pass custome time span in Pivot.

index=abc earliest=01/08/2015:11:00:00 latest=01/08/2015:11:12:00 | timechart span=2m count

The equivalent is using tstats is
| tstats count where earliest=01/08/2015:11:00:00 latest=01/08/2015:11:12:00 index=abc groupby _time span=1m

For you requirement with datamodel name DataModel_ABC, use the below command

| tstats count from datamodel=DataModel_ABC where earliest=01/08/2015:11:00:00 latest=01/08/2015:11:12:00 groupby _time span=2m

Hope this will help all splunkers and you too.

View solution in original post

sumitnagal
Path Finder

This works with some workaround on data model , here is new query

| tstats sum(ABC.time) as time FROM datamodel=DataModel_ABC groupby ABC.id,_time|| timechart avg(time) as time by id

however, I was using post processing in my dashboard. so now I have to write one direct query in dashboard.
second avg time value I am not able to round up, as after this search round function is not working, may be I am missing something
eval time=round(time,2)
third, I am plotting TPS, but using this model and printing below query doesn't give right information on data model.
| eval count=1 | timechart per_second(count)

0 Karma

jayannah
Builder

Hi, Today I was working on similar requirement.. so here is example how you can use accelerated datamodel and create timechart with custom timespan using tstats command. You can't pass custome time span in Pivot.

index=abc earliest=01/08/2015:11:00:00 latest=01/08/2015:11:12:00 | timechart span=2m count

The equivalent is using tstats is
| tstats count where earliest=01/08/2015:11:00:00 latest=01/08/2015:11:12:00 index=abc groupby _time span=1m

For you requirement with datamodel name DataModel_ABC, use the below command

| tstats count from datamodel=DataModel_ABC where earliest=01/08/2015:11:00:00 latest=01/08/2015:11:12:00 groupby _time span=2m

Hope this will help all splunkers and you too.

wangweibee
Explorer

I have the same problem, and hope to get a solution.

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...

State of Splunk Careers 2024: Maximizing Career Outcomes and the Continued Value of ...

For the past four years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

Data-Driven Success: Splunk & Financial Services

Splunk streamlines the process of extracting insights from large volumes of data. In this fast-paced world, ...