Splunk Search

How do I create a histogram to show distribution of hosts having particular range of uptime?

asingh4177
Engager

I have a search like this:

 

index=my_index search=my_search  | stats count as no_of_hosts by uptime

 

It gives me uptime of hosts present in our environment and no_of_hosts having that uptime.

I would like a chart that gives me uptime in range of say 0-10 days, 11-20, 21-30 and so on ( plotted on x axis ) and no_of_hosts which falls within this uptime range ( plotted on y axis ).

something like this:

Screen Shot 2021-01-19 at 2.55.29 AM.png

How do I achieve that in Splunk?

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

uptime is probably a string with trailing spaces - try:

index=my_index search=my_search | eval uptime=trim(uptime) | bin span=10 uptime | stats count as no_of_hosts by uptime

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hi @asingh4177,

Please try below;

index=my_index search=my_search  
| eval uptime=floor((if(uptime==0,0,uptime-1))/10)
| eval uptime=if(uptime==0,uptime*10,uptime*10+1)."-".((uptime+1)*10)
| stats count as no_of_hosts by uptime

 

If this reply helps you an upvote is appreciated.

If this reply helps you an upvote and "Accept as Solution" is appreciated.

ITWhisperer
SplunkTrust
SplunkTrust
index=my_index search=my_search | bin span=10 uptime | stats count as no_of_hosts by uptime
0 Karma

asingh4177
Engager

Thanks for reply but this didn't provide the intended solution.

This search just gave me first value  in uptime field in range of 0-10 with corresponding no_of_hosts field not providing correct number as well as other fields in uptime gave a single value as before.

To give you the clarity, here are the 2 searchs with o/p:

 

index=my_index search=my_search | bin span=10 uptime | stats count as no_of_hosts by uptime

 

Screen Shot 2021-01-19 at 10.40.39 AM.png

and here is my old search with o/p:

 

index=my_index search=my_search  | stats count as no_of_hosts by uptime

 

Screen Shot 2021-01-19 at 10.41.21 AM.png

Any help is appreciated..

Thanks in advance.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

uptime is probably a string with trailing spaces - try:

index=my_index search=my_search | eval uptime=trim(uptime) | bin span=10 uptime | stats count as no_of_hosts by uptime
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...