Splunk Search

How do I create a histogram to show distribution of hosts having particular range of uptime?

asingh4177
Engager

I have a search like this:

 

index=my_index search=my_search  | stats count as no_of_hosts by uptime

 

It gives me uptime of hosts present in our environment and no_of_hosts having that uptime.

I would like a chart that gives me uptime in range of say 0-10 days, 11-20, 21-30 and so on ( plotted on x axis ) and no_of_hosts which falls within this uptime range ( plotted on y axis ).

something like this:

Screen Shot 2021-01-19 at 2.55.29 AM.png

How do I achieve that in Splunk?

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

uptime is probably a string with trailing spaces - try:

index=my_index search=my_search | eval uptime=trim(uptime) | bin span=10 uptime | stats count as no_of_hosts by uptime

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hi @asingh4177,

Please try below;

index=my_index search=my_search  
| eval uptime=floor((if(uptime==0,0,uptime-1))/10)
| eval uptime=if(uptime==0,uptime*10,uptime*10+1)."-".((uptime+1)*10)
| stats count as no_of_hosts by uptime

 

If this reply helps you an upvote is appreciated.

If this reply helps you an upvote and "Accept as Solution" is appreciated.

ITWhisperer
SplunkTrust
SplunkTrust
index=my_index search=my_search | bin span=10 uptime | stats count as no_of_hosts by uptime
0 Karma

asingh4177
Engager

Thanks for reply but this didn't provide the intended solution.

This search just gave me first value  in uptime field in range of 0-10 with corresponding no_of_hosts field not providing correct number as well as other fields in uptime gave a single value as before.

To give you the clarity, here are the 2 searchs with o/p:

 

index=my_index search=my_search | bin span=10 uptime | stats count as no_of_hosts by uptime

 

Screen Shot 2021-01-19 at 10.40.39 AM.png

and here is my old search with o/p:

 

index=my_index search=my_search  | stats count as no_of_hosts by uptime

 

Screen Shot 2021-01-19 at 10.41.21 AM.png

Any help is appreciated..

Thanks in advance.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

uptime is probably a string with trailing spaces - try:

index=my_index search=my_search | eval uptime=trim(uptime) | bin span=10 uptime | stats count as no_of_hosts by uptime
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...