How to convert at InfluxDB SQL query to a Splunk SPL search?

[registration9]

We have a FIG (fluentD/InfluxDB/Grafana) setup in which we want to change the IG part to Splunk. We have several dashboards we need to convert. A picture of 1 of them is attached. The SQL query we use is:

SELECT mean(\"value\") FROM \"dev.agent\" WHERE (\"type\" = 'traffic-stats.rxpps' OR \"type\" = 'traffic-stats.txpps') AND \"device\" =~ /$host_regex/ AND \"interface\" =~ /$interface$/ AND $timeFilter GROUP BY \"device\", \"interface\", \"type\", time($GroupBy)"

What would the SPL look like? I have fluentD pushing the data into its only index in Splunk. The index is called "sandbox"

I assume the SPL query would start with

index="sandbox" AND (type="traffic-stats.rxpps" OR type="traffic-stats.txpps") AND (device=

That's as far as I have gotten. I need to dynamical select a device and interface. I have no clue how to code the "GROUP BY" SPL equivalent.

Thanks

[indeed_2000]

@registration9 did you connect splunkdb with influxdb?

i try it but got error:

https://community.splunk.com/t5/Splunk-Search/driver-influxdb-to-splunk-db/m-p/605850#M210681

would please how do you do this?

 Thanks 

[woodcock]

Like this:

index="sandbox" earliest=timeFilterMinValue latest=timeFilterMaxValue AND (type="traffic-stats.rxpps" OR type="traffic-stats.txpps")
| where match(device, "HostRegExHere") AND match(interface, "InterfaceRegExHere")
| eval dev_int_type = device . "/" . interface . "/". type
| timechart span=5m mean(value) BY dev_int_type