Splunk Search

How to best approach timeseries graph based on multiple fields?

AKG11
Path Finder

Hi, 

I am looking to create timeseries graph based on multiple fields.
we could have multiple hosts and each host have multiple CPU. 
Looking best approach to visualize it.

AKG11_0-1667818733808.png

Thanks

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try this

| bin _time span=1m
| stats avg(value) as avg by _time host cpu
| eval {cpu}=avg
| fields - avg cpu

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It depends on what you are trying to show!

You could use a trellis format, one tile for each host, or you could concatenate the host and cpu into a single field and display them all on one chart.

0 Karma

AKG11
Path Finder

@ITWhisperer  Thanks. I tried that but I am not be able to split by host.

Any idea ?

AKG11_0-1667820618140.png

 




0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

For trellis, you need to keep host and cpu separate - try something like this

| bin _time span=1m
| stats avg(value) as avg by _time host CPU

If you want them all on the same chart, then you concatenate host and cpu

0 Karma

AKG11
Path Finder

@ITWhisperer  I think it will be better to have separate graph for each host.

I tried what you suggested but it doesn't seems  like working.  Infact its not changing any thing in results. Am I missing something ?
basically in one chart it should show all CPU graph for single host.

AKG11_0-1667821519056.png

 




0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try this

| bin _time span=1m
| stats avg(value) as avg by _time host cpu
| eval {cpu}=avg
| fields - avg cpu
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...