Splunk Search

How to best approach timeseries graph based on multiple fields?

AKG11
Path Finder

Hi, 

I am looking to create timeseries graph based on multiple fields.
we could have multiple hosts and each host have multiple CPU. 
Looking best approach to visualize it.

AKG11_0-1667818733808.png

Thanks

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try this

| bin _time span=1m
| stats avg(value) as avg by _time host cpu
| eval {cpu}=avg
| fields - avg cpu

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It depends on what you are trying to show!

You could use a trellis format, one tile for each host, or you could concatenate the host and cpu into a single field and display them all on one chart.

0 Karma

AKG11
Path Finder

@ITWhisperer  Thanks. I tried that but I am not be able to split by host.

Any idea ?

AKG11_0-1667820618140.png

 




0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

For trellis, you need to keep host and cpu separate - try something like this

| bin _time span=1m
| stats avg(value) as avg by _time host CPU

If you want them all on the same chart, then you concatenate host and cpu

0 Karma

AKG11
Path Finder

@ITWhisperer  I think it will be better to have separate graph for each host.

I tried what you suggested but it doesn't seems  like working.  Infact its not changing any thing in results. Am I missing something ?
basically in one chart it should show all CPU graph for single host.

AKG11_0-1667821519056.png

 




0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try this

| bin _time span=1m
| stats avg(value) as avg by _time host cpu
| eval {cpu}=avg
| fields - avg cpu
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...