I know this should be a simple thing but I am trying to just chart out the trend of a value over time. I don't want an average or median or anything stats, i want the literal value that is being logged every 10secs or so. My log message is formatted in the following way
Feb 13 18:13:02 server01 PROCESS=enginedepth NAME=high VALUE=0
Feb 13 18:13:12 server01 PROCESS=enginedepth NAME=high VALUE=50
Feb 13 18:13:22 server01 PROCESS=enginedepth NAME=high VALUE=70
Feb 13 18:13:32 server01 PROCESS=enginedepth NAME=high VALUE=100
Feb 13 18:13:42 server01 PROCESS=enginedepth NAME=high VALUE=20
Feb 13 18:13:52 server01 PROCESS=enginedepth NAME=high VALUE=900
I am just looking to put number from the VALUE field in a chart for each NAME field.
The search query of "host=server01 PROCESS=enginedepth | timechart span=1m values(VALUE) by NAME limit=40 usenull=false useother=f" get close to what I am looking for but I get the additonal "total" line which throws off the charting. Plus I want to see all of the changes in the VALUE FIELD.
So my two questions are, is values() the correct stat to be used in this situation and is there a way to get rid of the auto-generated "total" field (green line in graph screenshot)?
I tried using this query to check to see the trend of spool by time but it does not work.
source="syslog.txt" $HASP646 PROCESS=enginedepth | chart values(Spool) by _time TimeEx
Source Report looks like this.
NR0000000 DCXA 15218 00:00:00.97 INTERNAL 00080A89 $HASP646 7.4688 PERCENT SPOOL UTILIZATION
Spool = 7.4688 TimeEx = 00:00:00 2 8/5/15
NR0000000 DCXA 15217 23:00:01.78 INTERNAL 00000080 $HASP646 7.4050 PERCENT SPOOL UTILIZATION
Spool = 7.4050 TimeEx = 23:00:01 3 8/5/15
NR0000000 DCXA 15217 22:00:02.11 INTERNAL 00080A89 $HASP646 9.0884 PERCENT SPOOL UTILIZATION
Spool = 9.0884 TimeEx = 22:00:02 4 8/5/15
NR0000000 DCXA 15217 21:00:01.91 INTERNAL 00080A89 $HASP646 9.0335 PERCENT SPOOL UTILIZATION
Spool = 9.0335 TimeEx = 21:00:01 5 8/5/15
NR0000000 DCXA 15217 20:00:01.21 INTERNAL 00080A89 $HASP646 8.9815 PERCENT SPOOL UTILIZATION
Spool = 8.9815 TimeEx = 20:00:01 6 8/5/15
NR0000000 DCXA 15217 19:00:01.62 INTERNAL 00080A89 $HASP646 8.9438 PERCENT SPOOL UTILIZATION
Spool = 8.9438 TimeEx = 19:00:01 7 8/5/15
NR0000000 DCXA 15217 18:00:02.01 INTERNAL 00000080 $HASP646 8.9057 PERCENT SPOOL UTILIZATION
Spool = 8.9057 TimeEx = 18:00:02
This is exactly what i was looking for, I didn't think using |fields -total would remove the splunk generated field of total but it does. please submit it as an answer and i will accept it
try to do a simple chart
<mysearch> PROCESS=enginedepth | chart values(VALUE) by _time NAME
or eventually add a bucketing
|bucket _time span=10s before.
While your suggestion works just as well as the timechart query I had, it still doesn't provide a way to get rid of the "total" line that automatically gets generated. Is there any way to get rid of that? It totally skews the chart I am interested in the individual names not the totals.