Splunk Search

Creating a line graph based on two different medians

wajeeh911
Engager

I have a table below in splunk. I'm trying the create a line graph which would graph four lines. The X axis would be the bypass value. The Y axis would be the the 50th percentile and 80th percentile of Type3 and and the 50th and 80th percentile of Type4. But there doesn't seem to be a way to do a stats, eval, if statement. 

Labels (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

@wajeeh911 

See this example - it first creates a similar data sample set to your data then just uses the chart statement to do what you describe.

| makeresults 
| eval n=mvrange(1,31)
| mvexpand n
| eval Type="Type".(random() % 2 + 3)
| eval Bypass="S".(random() % 3 + 37)
| eval TotalTime=random() % 15 + (random() / 100000)
| table TotalTime Bypass Type
| chart perc50(TotalTime) as p50 perc80(TotalTime) as p80 over Bypass by Type

Hope this helps

 

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...