Splunk Search

How do I create a histogram to show distribution of hosts having particular range of uptime?

asingh4177
Engager

I have a search like this:

 

index=my_index search=my_search  | stats count as no_of_hosts by uptime

 

It gives me uptime of hosts present in our environment and no_of_hosts having that uptime.

I would like a chart that gives me uptime in range of say 0-10 days, 11-20, 21-30 and so on ( plotted on x axis ) and no_of_hosts which falls within this uptime range ( plotted on y axis ).

something like this:

Screen Shot 2021-01-19 at 2.55.29 AM.png

How do I achieve that in Splunk?

Labels (2)
0 Karma
1 Solution

ITWhisperer
Legend

uptime is probably a string with trailing spaces - try:

index=my_index search=my_search | eval uptime=trim(uptime) | bin span=10 uptime | stats count as no_of_hosts by uptime

View solution in original post

scelikok
Champion

Hi @asingh4177,

Please try below;

index=my_index search=my_search  
| eval uptime=floor((if(uptime==0,0,uptime-1))/10)
| eval uptime=if(uptime==0,uptime*10,uptime*10+1)."-".((uptime+1)*10)
| stats count as no_of_hosts by uptime

 

If this reply helps you an upvote is appreciated.

If this reply helps you an upvote is appreciated.

ITWhisperer
Legend
index=my_index search=my_search | bin span=10 uptime | stats count as no_of_hosts by uptime
0 Karma

asingh4177
Engager

Thanks for reply but this didn't provide the intended solution.

This search just gave me first value  in uptime field in range of 0-10 with corresponding no_of_hosts field not providing correct number as well as other fields in uptime gave a single value as before.

To give you the clarity, here are the 2 searchs with o/p:

 

index=my_index search=my_search | bin span=10 uptime | stats count as no_of_hosts by uptime

 

Screen Shot 2021-01-19 at 10.40.39 AM.png

and here is my old search with o/p:

 

index=my_index search=my_search  | stats count as no_of_hosts by uptime

 

Screen Shot 2021-01-19 at 10.41.21 AM.png

Any help is appreciated..

Thanks in advance.

0 Karma

ITWhisperer
Legend

uptime is probably a string with trailing spaces - try:

index=my_index search=my_search | eval uptime=trim(uptime) | bin span=10 uptime | stats count as no_of_hosts by uptime

View solution in original post

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.