Splunk Search

Chart over multiple variables

atulitm
Path Finder

day_receive_time="Wed, Oct 25, 2017" device_name="apple" app="mssql-db" bandwidth_consumption="161"
day_receive_time="Wed, Oct 25, 2017" device_name="apple" app="ldap" bandwidth_consumption="146"
day_receive_time="Wed, Oct 25, 2017" device_name="grape" app="syslog" bandwidth_consumption="69"
day_receive_time="Wed, Oct 25, 2017" device_name="grape" app="syslog" bandwidth_consumption="69"

i would like have data in format
device_name app bandwidth_consumption
apple mssql-db 161
ldap 146
syslog 69
grape syslog 69

Unable to create query for same , Can some please help with building query for same .

0 Karma
1 Solution

niketn
Legend

@atulitm, I feel this is duplicate, I have already answered this question for you : https://answers.splunk.com/answers/586137/how-to-use-chart-command-to-get-data-over-3-variab.html

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@atulitm, I feel this is duplicate, I have already answered this question for you : https://answers.splunk.com/answers/586137/how-to-use-chart-command-to-get-data-over-3-variab.html

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

elliotproebstel
Champion

Give this a try:
your base search | stats values(app) AS app values(bandwidth_consumption) AS bandwidth_consumption BY device_name

Here's some guidance on how to use stats in your searches:
http://docs.splunk.com/Documentation/Splunk/7.0.0/Search/Usethestatscommandandfunctions

atulitm
Path Finder

Actually also i need that data on per day_receive_time variable mention in logs so in other words i will be getting bwconsumption data daily for one device for each app and i want to show that in table per day ... coloum header should be variable
day_receive_time .. unable to create . can you plz help with same

0 Karma

elliotproebstel
Champion

So perhaps what you need is this:
your base search | stats values(app) AS app values(bandwidth_consumption) AS bandwidth_consumption by day_receive_time device_name

atulitm
Path Finder

Thanks , i tried that before but problem is that i need dates to be column header and this query makes them as row .. Also i had tried adding
your base search | stats values(app) AS app values(bandwidth_consumption) AS bandwidth_consumption by day_receive_time device_name| transpose header_field=device_name | fields - column
but it doesnt work , i need dates as column header where it shows bandwidth_consumption underneath so it shows per app per day stats , so that in one table we could compare how bandwidth_consumption is increasing/decreasing and also if we can have that in chart .

0 Karma

niketn
Legend

@atulitm, I think your current requirement has changed from the original table that you have posted in your question. Please post a sample updated table as per your need, so that community members can assist.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

atulitm
Path Finder

device_name app bandwidth_consumption
Wed, Oct 25, 2017 Thurs, Oct 26, 2017

apple mssql-db 161 120
ldap 146 132
syslog 69 85
grape syslog 69 80

Wed, Oct 25, 2017 and Thurs, Oct 26, 2017 you see in output are values of variable "day_receive_time" in log
@niketnilay I am looking for something like this which shows bandwidth_consumption of each app per device per day and also a chart out of it . I tried using stats command , i can get output but not in way i want . thnx

0 Karma

atulitm
Path Finder

One more thing .. this looks like giving me desired results but problem is it creates column for app too per day where i need to see app and then how much bandwidth_consumption per day as shown above .
index | chart values(app) AS app values(bandwidth_consumption) AS bandwidth_consumption by device_name day_receive_time

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...