Splunk Search

Help with creating search to chart current data against calcuated averages.

lyndac
Contributor

I am indexing some data in json format. The json has some fields that are arrays like:
{
system: "peanuts",
location: "california",
size: 12345
keywords: ["apples", "oranges", "bananas"]
}
I get around 500,000 events like this per day. It seems weird, but the size is attributed to each keyword completely such that stats sum(size) by keywords should give apples:12345, oranges:12345, bananas:12345.

To chart this, I might say "index=foo | mvexpand keywords{} | rename keywords{} as keywords| stats sum(size) as Total by keywords" with a time range of "past 60 minutes". I display this as a bar chart.

My boss likes this chart, but now he wants to see how today's totals compare with what we "normally" see. And he wants to be able to tell "at a glance" if today's totals deviate by too much (say if today's value at a given hour is >25% of normal or < 25% of normal). (possibly by changing the color of the graph for that section?)

I know this is possible, but I am not sure where to start to make it happen. How do I display two searches that search over different time frames on the same timechart? Should I use summary indexing to speed up the searches? Once I have the timechart, can I use simple XML dashboard to "highlight" sections/periods that are outside the acceptable range?

0 Karma
1 Solution

woodcock
Esteemed Legend
0 Karma

woodcock
Esteemed Legend

You need the Timewrap app:

https://splunkbase.splunk.com/app/1645/

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...