Splunk Search

Chart

mvasquez21
Explorer

My boss has asked me to create a chart that shows the number of fired alerts (y-axis) by day of the month (x-axis). I suggested we do this as a stacked chart with each alert represented by a different color. I know the alert variable is "ss_name" and i found this expression to create the "date":

convert timeformat="%m-%d" ctime(_time) AS date

I just cant get the correct syntax to get all 3 elements in to the chart. So far i have this:

index=_audit action="alert_fired" | convert timeformat="%m-%d" ctime(_time) AS date | timechart date by ss_name

 

Thanks!

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try adding

| xyseries date, ss_name, count

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

How about something like

index=_audit action="alert_fired" | convert timeformat="%m-%d" ctime(_time) AS date | stats count by ss_name, date

Then use a stacked bar chart in your dashboard panel 

0 Karma

mvasquez21
Explorer

i had tried that one already but it puts count and date as the only x-axis items instead of the ss_name (alerts)

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try adding

| xyseries date, ss_name, count

mvasquez21
Explorer

mvasquez21_0-1598626596705.png

 

0 Karma

mvasquez21
Explorer

perfect! thanks!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mvasquez21,

why do you want to complicate the search?

timechart is sufficient for your need:

 

index=_audit action="alert_fired" earliest=-30d@d latest=@d
| timechart span=1d count

 

if you want to know how many alerts you fired for each kind of alert, you could run something like this:

 

index=_audit action="alert_fired" earliest=-30d@d latest=@d
| timechart span=1d count BY ss_name

 

but it depends on the number of different alerts: if they are too many your chart isn't readable.

 

The problem is that you want to run a search on a long time (one month) and, if you have many events, this is a very slow search.

So you could schedule this  search as a report by night and display it very quickly or schedule a search saving results in a summary index and running the search on the summary index.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...