Splunk Search

How do I create a histogram to show distribution of hosts having particular range of uptime?

asingh4177
Engager

I have a search like this:

 

index=my_index search=my_search  | stats count as no_of_hosts by uptime

 

It gives me uptime of hosts present in our environment and no_of_hosts having that uptime.

I would like a chart that gives me uptime in range of say 0-10 days, 11-20, 21-30 and so on ( plotted on x axis ) and no_of_hosts which falls within this uptime range ( plotted on y axis ).

something like this:

Screen Shot 2021-01-19 at 2.55.29 AM.png

How do I achieve that in Splunk?

Labels (2)
0 Karma
1 Solution

ITWhisperer
Ultra Champion

uptime is probably a string with trailing spaces - try:

index=my_index search=my_search | eval uptime=trim(uptime) | bin span=10 uptime | stats count as no_of_hosts by uptime

View solution in original post

scelikok
Champion

Hi @asingh4177,

Please try below;

index=my_index search=my_search  
| eval uptime=floor((if(uptime==0,0,uptime-1))/10)
| eval uptime=if(uptime==0,uptime*10,uptime*10+1)."-".((uptime+1)*10)
| stats count as no_of_hosts by uptime

 

If this reply helps you an upvote is appreciated.

If this reply helps you an upvote is appreciated.

ITWhisperer
Ultra Champion
index=my_index search=my_search | bin span=10 uptime | stats count as no_of_hosts by uptime
0 Karma

asingh4177
Engager

Thanks for reply but this didn't provide the intended solution.

This search just gave me first value  in uptime field in range of 0-10 with corresponding no_of_hosts field not providing correct number as well as other fields in uptime gave a single value as before.

To give you the clarity, here are the 2 searchs with o/p:

 

index=my_index search=my_search | bin span=10 uptime | stats count as no_of_hosts by uptime

 

Screen Shot 2021-01-19 at 10.40.39 AM.png

and here is my old search with o/p:

 

index=my_index search=my_search  | stats count as no_of_hosts by uptime

 

Screen Shot 2021-01-19 at 10.41.21 AM.png

Any help is appreciated..

Thanks in advance.

0 Karma

ITWhisperer
Ultra Champion

uptime is probably a string with trailing spaces - try:

index=my_index search=my_search | eval uptime=trim(uptime) | bin span=10 uptime | stats count as no_of_hosts by uptime

View solution in original post

Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!