Splunk Search

Build a chart of multiple data series

guilmxm
SplunkTrust
SplunkTrust

Hi to everyone,

I am designing an application where my users will potentially need to be able to generate a chart with multiple data series. (depending on their own selection and various options available)

I searched in different posts and i followed this doc with success:
http://docs.splunk.com/Documentation/Splunk/latest/Search/Chartmultipledataseries

This works good, but still i have a small issue with the chart being created in the dashboard, the time period is technically correct but not being shown as would generates the timechart command. (each date section is being shown so too much data with more than a few hours)

A correct chart generated with timechart:
alt text

A chart generating with the stat command with multiple series:
alt text

My command is the following:

index="rls_index" sourcetype="rls_source" $hostname$ $monitor$ $monitor_label$
bucket _time span=1h | stats max(value) As ValMax, min(value) As ValMin by _time,monitor_label |
eval s1="max min" | makemv s1 | mvexpand s1 | eval yval=case(s1=="max",ValMax,s1=="min",ValMin) | eval series=monitor_label+":"+s1 | convert ctime(_time) as time | xyseries time,series,yval

I needed to add the section "convert ctime(_time) as time" to get a shorter and more readable time format.

Does anyone knows how to generate a chart with the time period being correctly shown like with timechart ?

I had to use the bucket command to limit the amount of data generated, i also would like to put a timerange condition like the timechart command automatically does ? (something like if more than 1 day then bucket 1 hour and so on)

Thank you in advance for any help you could provide.

Long live to Splunk ^^

Tags (3)

jonuwz
Influencer

Use _time in xyseries and add ... | makecontinuous _time to the end. You don't need to convert _time beforehand.

The charting stuff makes the x-axis labels 'pretty' if it contains regularly intervaled epoch values

jonuwz
Influencer

Thanks Guilhem. Accepting the answer is the usual way to award rep (you dont have to spend your own)

0 Karma

guilmxm
SplunkTrust
SplunkTrust

Hi,

Thank you very much, you perfectly answered to my question!

Guilhem

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...