Splunk Search

How to chart the number of occurrences including its respective threshold for each host and each eventtype?

zapping575
Path Finder

Hi everybody,

I have the following problem and cannot seem to be able to wrap my head around it:

  1. I have a bunch of eventtypes (close to 1000).
  2. Some of those eventtypes have certain thresholds which are greater than zero. I look the values up from a csv
  3. For a single host, I'd like to
    1. Chart the number of occurrances for an eventtype IF
      1. That number of occurrances is higher than the aforementioned threshold
      2. The chart shall also contain a static line depicting the threshold value

Here is what I have so far. I believe I am always getting lost when using an aggregate function such as count() because added something to the result using eval just wont work.

 

 

index="my_index" eventtype=* host="$HOST_FROM_DROPDOWN$"  
| lookup my-events eventtype 
| eventstats count by eventtype 
| where alert_threshold > 0 AND count > alert_threshold
| stats count by eventtype 
| eval Threshold = alert_threshold

 

 What I do understand is that I have to add the "Threshold" variable in the overlay Options of the chart.

Any help is much appreciated. Thank you

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| stats count values(alert_threshold) as alert_threshold by eventtype 

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| stats count values(alert_threshold) as alert_threshold by eventtype 

zapping575
Path Finder

Thank you very much. I got it working as expected like this:

index="my_index" eventtype=* host="dropdown_value..."  
| lookup my_lookup eventtype 
| stats count values(alert_threshold) as alert_threshold by eventtype 
| where alert_threshold > 0 AND count > alert_threshold
| sort count desc

 

Now the only thing left is that the threshold value is drawn as a dot in the chart. I'd like it to be a line going across the entire bar. Is that possible?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You will get a dot if there is only 1 point on the line e.g. only one event type breaches the threshold

0 Karma

zapping575
Path Finder

Acknowledged. thanks

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...