Splunk Search

Help with timechart overlay?

Explorer

Hi,

I have a search that plots CPU and max Attendees over time. It's rather convoluted, and I'm wondering if there's a better way. I'm pretty new to splunk. Any suggestions?

host="freeswitch" sourcetype="cpu" | eval earliest=info_min_time | eval latest=info_max_time | multikv |
append [search host="freeswitch" sourcetype="cdr_xml" |
eval Conf_Start=strftime(startTime,"%H:%M:%S %m/%d/%y") |
eventstats count(callerName) as Attendees by Conf_Start] |
timechart span=5m max(cpu_user_percent) as CPU max(Attendees) as Attendees

thanks,
mike

0 Karma
1 Solution

Motivator

Try this

host="freeswitch" sourcetype="cpu" 
| eval earliest=info_min_time 
| eval latest=info_max_time 
| multikv 
| timechart span=5m max(cpu_user_percent) as CPU 
| appendcols 
    [ search host="freeswitch" sourcetype="cdr_xml" 
    | eval Conf_Start=strftime(startTime,"%H:%M:%S %m/%d/%y") 
    | eventstats count(callerName) as Attendees by Conf_Start 
    | timechart span=5m max(Attendees) as Attendees]

View solution in original post

0 Karma

Motivator

Try this

host="freeswitch" sourcetype="cpu" 
| eval earliest=info_min_time 
| eval latest=info_max_time 
| multikv 
| timechart span=5m max(cpu_user_percent) as CPU 
| appendcols 
    [ search host="freeswitch" sourcetype="cdr_xml" 
    | eval Conf_Start=strftime(startTime,"%H:%M:%S %m/%d/%y") 
    | eventstats count(callerName) as Attendees by Conf_Start 
    | timechart span=5m max(Attendees) as Attendees]

View solution in original post

0 Karma

Explorer

kmaron, is your way quicker, or less processor intensive? it's definitely aesthetically better.

0 Karma

Motivator

I'm not sure if it's quicker or more efficient you'd have to run the queries and compare them. I just learned to use appendcols to put two graphs into one.

This has a nice explanation of the differences in the append type commands if that helps: https://answers.splunk.com/answers/144351/what-are-the-differences-between-append-appendpipe.html

0 Karma

Revered Legend
0 Karma

Explorer

Thanks. I saw that, but my data comes from two different source types. i wasn't sure how to get the the data from the second source type without a separate search.

0 Karma

Motivator
0 Karma

Explorer

Cool. i definitely like it better than the one i was using. thanks.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!