Splunk Search

Dynamically changing the x-axis values

ngerosa
Path Finder

Hi all,
I have this search:

 index="attenuation"
|dedup CONCATENATE_Z
|eval TRATTA=NODO_A."->".NODO_Z 
|lookup eol.csv TRATTA OUTPUT eol as EOL
|search TRATTA="ROMA->MILANO"
|eval DATA=strftime(strptime('END_OF_INTERVAL',"%Y-%m-%d"),"%Y-%m-%d")
|table DATA SPAN_LOSS EOL
| sort DATA

For every "TRATTA" I have many "SPAN_LOSS" values (one per day).
Plotting the chart I can't visualize the values of x-axis maybe because are too many.

How Can I visualize the values of DATA for example grouped by week or month?

Thanks!

Tags (2)
0 Karma

DalJeanis
Legend

From the information that you have provided, we cannot tell what form SPAN_LOSS might take. Below, I'm assuming that it is some kind of number, and that for any particular unit of time you want the sum of that number for the period.

I'm assuming the part of your search limiting your results to the segment from Rome to Milan ("ROMA->MILANO") is not part of your overall requirements, or you'd be doing it in the original search at the top. I've moved it up, but you can pull it out completely after you do some testing.

Try this...

  index="attenuation" NODO_A="Roma" NODO_Z="Milano"
 | fields CONCATENATE_Z NODO_A NODO_Z END_OF_INTERVAL SPAN_LOSS
 | dedup CONCATENATE_Z
 | eval TRATTA=NODO_A."->".NODO_Z 
 | lookup eol.csv TRATTA OUTPUT eol as EOL
 | eval _time=strptime('END_OF_INTERVAL',"%Y-%m-%d")
 | table _time SPAN_LOSS EOL
 | timechart sum(SPAN_LOSS) by EOL 

... and then you can try chunking it up to the week span=1w or month span=1mon levels.

 | timechart span=1w sum(SPAN_LOSS) by EOL 
0 Karma

ngerosa
Path Finder

Hi DalJeanis,
I didn't use timechart because I don't want to do any statistical operation, I want to display, for every "TRATTA", all values of "SPAN_LOSS" and "EOL".
The chart has to display the trend of "SPAN_LOSS" compared to "EOL" over time

0 Karma
Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...