Splunk Search

Convert timechart to table

jtrucks
Splunk Employee
Splunk Employee

I need to convert the search output from using timechart to a table so I can have only a three column display output (for my specific bubble charting needs).

The search:

index=_internal source=*license_usage.log type=Usage | eval GB=b/1024/1024/1024 | timechart span=1d sum(GB) by s useother=false usenull=false

Existing output has many columns like:

_time      /path/to/file.log /path/to/otherfile.log /path/to/foo /path/to/bar
7/23/13 2.8                      1.6                             4.6                 3.9
7/24/13 3.0                      1.9                             3.9                  4.2

What I need is something like:

_time      source                        GB
7/23/13 /path/to/file.log         2.8
7/23/13 /path/to/otherfile.log 1.6
7/23/13 /path/to/foo               4.6
7/23/13 /path/to/bar               3.9
7/24/13 /path/to/file.log          3.0
7/24/13 /path/to/otherfile.log  1.9
7/24/13 /path/to/foo                3.9
7/24/13 /path/to/bar                4.2

Any help please?

--
Jesse Trucks
Minister of Magic
Tags (3)
1 Solution

Ayn
Legend

Use stats instead (and use bucket to create the timespans):

index=_internal source=*license_usage.log type=Usage | eval GB=b/1024/1024/1024 | bucket _time span=1d | stats sum(GB) by _time,s

View solution in original post

Ayn
Legend

Use stats instead (and use bucket to create the timespans):

index=_internal source=*license_usage.log type=Usage | eval GB=b/1024/1024/1024 | bucket _time span=1d | stats sum(GB) by _time,s

linu1988
Champion

The below also gives us a good info :

| rest /services/licenser/pools| where title = "Indexers"|eval Total=(used_bytes/1024/1024/1024)

0 Karma

jtrucks
Splunk Employee
Splunk Employee

Well, the formatting is hosed, but hopefully what I'm getting at is clear.

--
Jesse Trucks
Minister of Magic
0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...