Splunk Search

Extracting / Plotting Splunk data

netwrkr
Communicator

Assume we have a log file with at least the following fields

  timestamp   field A   field B   field C .....

  ex:

  1316018215   u1       105        a
  1316018215   u2       30         a
  1316018215   u3       550        c
  1316018215   u2        21        a
  1316018215   u1       65         b
  1316018215   u3       105        a
  1316018215   u2        34        b
  1316018215   u1       105        c

The question: I would like to ask the following questions of this data

1. Plot for me a graph of Unique C vs. (sum of B for each unique C )
2. Plot for me a graph of Unique C vs. (sum of B for each unique C div count of occurrences).
0 Karma

Ayn
Legend

#1:

<yourbasesearch> | stats sum(B) by C

#2:

<yourbasesearch> | stats avg(B) by C
Get Updates on the Splunk Community!

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...