Splunk Search

Graph by two fields

AlexMcDuffMille
Communicator

Hello,

I have a log file that creates 3 unique files for each node every 15 minutes. I would like to graph the PercentUsed by HDD and by NODE, so for this example I would have 6 different lines. Currently I'm using an eval statement to concatenate the NODE and the HDD as a new field and graphing 'by new_field'.

Is there a more elegant way of doing this? Maybe somehow saying max(Percent_Used) by HDD by NODE?

The files look like this:

2013-11-19 07:52:06 (NODE1) HDD=1 Percent_Used=49%

2013-11-19 07:52:05 (NODE1) HDD=2 Percent_Used=19%

2013-11-19 07:52:05 (NODE1) HDD=3 Percent_Used=37%

2013-11-19 07:52:06 (NODE2) HDD=1 Percent_Used=50%

2013-11-19 07:52:05 (NODE2) HDD=2 Percent_Used=66%

2013-11-19 07:52:05 (NODE2) HDD=3 Percent_Used=05%

Thanks!!

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi AlexMcDuffMiller,

you can use chart for this kind of tables, see docs for the chart ... over ... by example.
If you want a table like output, the by argument sets the columns and the over argument sets the rows.

hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi AlexMcDuffMiller,

you can use chart for this kind of tables, see docs for the chart ... over ... by example.
If you want a table like output, the by argument sets the columns and the over argument sets the rows.

hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...