Splunk Search

How can I use results of a stats table to output to another pipe or timechart?

Explorer

index=source earliest=-2h sourcetype=e | bucket _time span=1h |stats count by code _time| delta count as difference | eval percdif=round(abs(difference/count)*100,0)|table code, count, difference, percdif|sort -percdif -count|where count>1100|fields code|head 10

I am using this query. output basically will return error codes sorted with high percentage difference (errors are increasing). I am using fields command to only output top 10 errors in table

since this query will show as stats table, how can I use this output to further pipe or do a timechart?

0 Karma

Revered Legend

If your timechart query's timerange is different from last 2 hr, then try like this

index=source [search index=source earliest=-2h sourcetype=e | bucket _time span=1h |stats count by code _time| delta count as difference | eval percdif=round(abs(difference/count)*100,0)|table code, count, difference, percdif|sort -percdif -count|where count>1100|fields code|head 10] 
| timechart count by code

Explorer

It did not work, returns 0 results

0 Karma

Revered Legend

How about this

index=source sourcetype=e  [search index=source earliest=-2h sourcetype=e | bucket _time span=1h |stats count by code _time| delta count as difference | eval percdif=round(abs(difference/count)*100,0)|table code, count, difference, percdif|sort -percdif -count|where count>1100|fields code|head 10] 
 | timechart count by code

Explorer

does this work if I pass more than one field (code and percdif) to timechart as well?

0 Karma

Revered Legend

It'll. As long as that field is present in main search.

0 Karma

Explorer

Thanks working now

0 Karma

Revered Legend

What's your final expected output (that you want to generate for these top 10 error codes)?

0 Karma

Explorer

Final output should be a timechart of the top 10 error codes (of query I posted above)

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!