I am receiving SNMP data using the SNMP Modular Input application. The extraction configurated in this application is able to give a list of indexes, oids, and values. I am trying to accomplish a timechart plot of errorCounter values separated by the different compID values. Currently I am able to create a table organized in the format that I want but I cannot use the same data to create a timechart. My sample event and search are provided below.
MIB::errorCounter."0" = "12" MIB::errorCounter."1" = "23" MIB::errorCounter."2" = "9" MIB::errorCounter."3" = "13" MIB::compID."0" = "comid1" MIB::compID."1" = "acom2" MIB::compID."2" = "othercomid" MIB::compID."3" = "hi"
host = 127.0.0.1 index = main oid = errorCounter oid = errorCounter oid = errorCounter oid = errorCounter oid = compID oid = compID oid = compID oid = compID snmp_index = 0 snmp_index = 1 snmp_index = 2 snmp_index = 3 snmp_index = 0 snmp_index = 1 snmp_index = 2 snmp_index = 3 source = snmp://SNMP Sim Test sourcetype = snmp_ta value = 12 value = 23 value = 9 value = 13 value = comid1 value = acom2 value = othercomid value = hi
sourcetype="snmp_ta"
| eval d=mvzip(oid,snmp_index), e=mvzip(d,value)
| mvexpand e
| eval f1=mvfilter(match(e,".error."))
| eval f2=mvfilter(match(e,".compID."))
| eval comid=mvindex(split(f2,","),2), errorval=mvindex(split(f1,","),2)
| stats list(comid) as "Computer", list(errorval) as "Error Count" by _time
I tried the adding the line | timechart avg(errorval) by comid but no stats or visualization appears. Any help is appreciated. Thank you so much.
