Splunk Search

How to best approach timeseries graph based on multiple fields?

AKG11
Path Finder

Hi, 

I am looking to create timeseries graph based on multiple fields.
we could have multiple hosts and each host have multiple CPU. 
Looking best approach to visualize it.

AKG11_0-1667818733808.png

Thanks

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try this

| bin _time span=1m
| stats avg(value) as avg by _time host cpu
| eval {cpu}=avg
| fields - avg cpu

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It depends on what you are trying to show!

You could use a trellis format, one tile for each host, or you could concatenate the host and cpu into a single field and display them all on one chart.

0 Karma

AKG11
Path Finder

@ITWhisperer  Thanks. I tried that but I am not be able to split by host.

Any idea ?

AKG11_0-1667820618140.png

 




0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

For trellis, you need to keep host and cpu separate - try something like this

| bin _time span=1m
| stats avg(value) as avg by _time host CPU

If you want them all on the same chart, then you concatenate host and cpu

0 Karma

AKG11
Path Finder

@ITWhisperer  I think it will be better to have separate graph for each host.

I tried what you suggested but it doesn't seems  like working.  Infact its not changing any thing in results. Am I missing something ?
basically in one chart it should show all CPU graph for single host.

AKG11_0-1667821519056.png

 




0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try this

| bin _time span=1m
| stats avg(value) as avg by _time host cpu
| eval {cpu}=avg
| fields - avg cpu
0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...