Splunk Search

How do I create a histogram to show distribution of hosts having particular range of uptime?

asingh4177
Engager

I have a search like this:

 

index=my_index search=my_search  | stats count as no_of_hosts by uptime

 

It gives me uptime of hosts present in our environment and no_of_hosts having that uptime.

I would like a chart that gives me uptime in range of say 0-10 days, 11-20, 21-30 and so on ( plotted on x axis ) and no_of_hosts which falls within this uptime range ( plotted on y axis ).

something like this:

Screen Shot 2021-01-19 at 2.55.29 AM.png

How do I achieve that in Splunk?

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

uptime is probably a string with trailing spaces - try:

index=my_index search=my_search | eval uptime=trim(uptime) | bin span=10 uptime | stats count as no_of_hosts by uptime

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hi @asingh4177,

Please try below;

index=my_index search=my_search  
| eval uptime=floor((if(uptime==0,0,uptime-1))/10)
| eval uptime=if(uptime==0,uptime*10,uptime*10+1)."-".((uptime+1)*10)
| stats count as no_of_hosts by uptime

 

If this reply helps you an upvote is appreciated.

If this reply helps you an upvote and "Accept as Solution" is appreciated.

ITWhisperer
SplunkTrust
SplunkTrust
index=my_index search=my_search | bin span=10 uptime | stats count as no_of_hosts by uptime
0 Karma

asingh4177
Engager

Thanks for reply but this didn't provide the intended solution.

This search just gave me first value  in uptime field in range of 0-10 with corresponding no_of_hosts field not providing correct number as well as other fields in uptime gave a single value as before.

To give you the clarity, here are the 2 searchs with o/p:

 

index=my_index search=my_search | bin span=10 uptime | stats count as no_of_hosts by uptime

 

Screen Shot 2021-01-19 at 10.40.39 AM.png

and here is my old search with o/p:

 

index=my_index search=my_search  | stats count as no_of_hosts by uptime

 

Screen Shot 2021-01-19 at 10.41.21 AM.png

Any help is appreciated..

Thanks in advance.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

uptime is probably a string with trailing spaces - try:

index=my_index search=my_search | eval uptime=trim(uptime) | bin span=10 uptime | stats count as no_of_hosts by uptime
Get Updates on the Splunk Community!

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...

Splunk With AppDynamics - Meet the New IT (And Engineering) Couple

Wednesday, November 20, 2024  |  10AM PT / 1PM ET Register Now Join us in this session to learn all about ...