Reporting

how to pass time span in datamodel

sumitnagal
Path Finder

We have few data model, but we are not able to pass the span / PERIOD other then default values. this is creating problem as we are not able to put different bucket options (1m, 10 m, 1 h ...) and our chart data is exceeding more then 1000 points. here is simple data model query

| pivot DataModel_ABC perf count(TPS) AS "tps" sum(execTime) AS "execTime" SPLITROW _time AS _time PERIOD auto SPLITROW host AS hostname

Please let me know

Tags (1)
1 Solution

jayannah
Builder

Hi, Today I was working on similar requirement.. so here is example how you can use accelerated datamodel and create timechart with custom timespan using tstats command. You can't pass custome time span in Pivot.

index=abc earliest=01/08/2015:11:00:00 latest=01/08/2015:11:12:00 | timechart span=2m count

The equivalent is using tstats is
| tstats count where earliest=01/08/2015:11:00:00 latest=01/08/2015:11:12:00 index=abc groupby _time span=1m

For you requirement with datamodel name DataModel_ABC, use the below command

| tstats count from datamodel=DataModel_ABC where earliest=01/08/2015:11:00:00 latest=01/08/2015:11:12:00 groupby _time span=2m

Hope this will help all splunkers and you too.

View solution in original post

sumitnagal
Path Finder

This works with some workaround on data model , here is new query

| tstats sum(ABC.time) as time FROM datamodel=DataModel_ABC groupby ABC.id,_time|| timechart avg(time) as time by id

however, I was using post processing in my dashboard. so now I have to write one direct query in dashboard.
second avg time value I am not able to round up, as after this search round function is not working, may be I am missing something
eval time=round(time,2)
third, I am plotting TPS, but using this model and printing below query doesn't give right information on data model.
| eval count=1 | timechart per_second(count)

0 Karma

jayannah
Builder

Hi, Today I was working on similar requirement.. so here is example how you can use accelerated datamodel and create timechart with custom timespan using tstats command. You can't pass custome time span in Pivot.

index=abc earliest=01/08/2015:11:00:00 latest=01/08/2015:11:12:00 | timechart span=2m count

The equivalent is using tstats is
| tstats count where earliest=01/08/2015:11:00:00 latest=01/08/2015:11:12:00 index=abc groupby _time span=1m

For you requirement with datamodel name DataModel_ABC, use the below command

| tstats count from datamodel=DataModel_ABC where earliest=01/08/2015:11:00:00 latest=01/08/2015:11:12:00 groupby _time span=2m

Hope this will help all splunkers and you too.

wangweibee
Explorer

I have the same problem, and hope to get a solution.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...