We have a FIG (fluentD/InfluxDB/Grafana) setup in which we want to change the IG part to Splunk. We have several dashboards we need to convert. A picture of 1 of them is attached. The SQL query we use is:
SELECT mean(\"value\") FROM \"dev.agent\" WHERE (\"type\" = 'traffic-stats.rxpps' OR \"type\" = 'traffic-stats.txpps') AND \"device\" =~ /$host_regex/ AND \"interface\" =~ /$interface$/ AND $timeFilter GROUP BY \"device\", \"interface\", \"type\", time($GroupBy)"
What would the SPL look like? I have fluentD pushing the data into its only index in Splunk. The index is called "sandbox"
I assume the SPL query would start with
index="sandbox" AND (type="traffic-stats.rxpps" OR type="traffic-stats.txpps") AND (device=
That's as far as I have gotten. I need to dynamical select a device and interface. I have no clue how to code the "GROUP BY" SPL equivalent.