Splunk Search

Help with timecharts

cjohnson_vectra
New Member

New to splunk so aplogies if this question is not worded correctly. Trying to generate a view (sparkline?) that compares the cumulative value of events over a given period with the current value. I have a query in place the will show me the count of events that happened each day based on the defined time period:

index=* name="event type" | dedup src | timechart count

but now I want to generate a sparkline that compares the total count with the current value day's value. This will be presented in a single value field.

0 Karma

chimell
Motivator

Hi
Try this search code

index=* name="event type" | dedup src | timechart count as Total_count|appendcols[search index=* name="event type" | dedup src | timechart span=1d count as daily_count]|eval diff=Total_count-daily_count|stats sparkline count(diff)
0 Karma

somesoni2
Revered Legend

Could you provide more details on expected output?

0 Karma

cjohnson_vectra
New Member

Actually, I think I over simplified my question which is why I am having such a hard time getting my arms around this problem. In my case, the "event type" is actually a state that can change at any given time. (i.e. machine x changed from state 'a' to state 'b')

So I just realized that part of my problem is that I am deduping which eliminates all events except for the final state change. This in combination of the idea that I am not keeping a running tally for each day, I don't see an easy way to track trends.

In the end, what I was hoping to accomplish was show trends in change in state over a period of time. I just need to rethink this a little.

Thanks for the response. Greatly appreciated.

0 Karma

Richfez
SplunkTrust
SplunkTrust

Sure, that all sounds like fun. We may still be able to help if you could provide a few sample events - I think you are clear enough on your description above that with those two things a start could be made. Sometimes that's all it takes to get your own juices flowing...

0 Karma

cjohnson_vectra
New Member

Rich, here are a couple of event:

Mar 4 06:00:50 192.168.15.125 Mar 4 06:00:01 S14945214214616 - -: CEF:0|Vectra Networks|Vectra|2.3|hsc|Host Score Change|3|externalId=5084 cat=HOST SCORING shost=BThomas-Win7 src=192.168.111.3 dst=192.168.111.3 flexNumber1=84 flexNumber1Label=risk cs4=https://192.168.15.125/hosts/5084 cs4Label=URL start=1457100001073 end=1457100001073

Mar 4 03:00:50 192.168.15.125 Mar 4 03:00:01 S14945214214616 - -: CEF:0|Vectra Networks|Vectra|2.3|hsc|Host Score Change|3|externalId=5086 cat=HOST SCORING shost=WSmith_WinPC src=192.168.111.2 dst=192.168.111.2 flexNumber1=64 flexNumber1Label=risk cs4=https://192.168.15.125/hosts/5086 cs4Label=URL start=1457089201104 end=1457089201104

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...