Splunk Search

How to chart the number of occurrences including its respective threshold for each host and each eventtype?

zapping575
Explorer

Hi everybody,

I have the following problem and cannot seem to be able to wrap my head around it:

  1. I have a bunch of eventtypes (close to 1000).
  2. Some of those eventtypes have certain thresholds which are greater than zero. I look the values up from a csv
  3. For a single host, I'd like to
    1. Chart the number of occurrances for an eventtype IF
      1. That number of occurrances is higher than the aforementioned threshold
      2. The chart shall also contain a static line depicting the threshold value

Here is what I have so far. I believe I am always getting lost when using an aggregate function such as count() because added something to the result using eval just wont work.

 

 

index="my_index" eventtype=* host="$HOST_FROM_DROPDOWN$"  
| lookup my-events eventtype 
| eventstats count by eventtype 
| where alert_threshold > 0 AND count > alert_threshold
| stats count by eventtype 
| eval Threshold = alert_threshold

 

 What I do understand is that I have to add the "Threshold" variable in the overlay Options of the chart.

Any help is much appreciated. Thank you

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| stats count values(alert_threshold) as alert_threshold by eventtype 

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| stats count values(alert_threshold) as alert_threshold by eventtype 

zapping575
Explorer

Thank you very much. I got it working as expected like this:

index="my_index" eventtype=* host="dropdown_value..."  
| lookup my_lookup eventtype 
| stats count values(alert_threshold) as alert_threshold by eventtype 
| where alert_threshold > 0 AND count > alert_threshold
| sort count desc

 

Now the only thing left is that the threshold value is drawn as a dot in the chart. I'd like it to be a line going across the entire bar. Is that possible?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You will get a dot if there is only 1 point on the line e.g. only one event type breaches the threshold

0 Karma

zapping575
Explorer

Acknowledged. thanks

0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...