Splunk Search

How to create a chart from output of index and dataset?

AmitSampat
Loves-to-Learn Lots

All,

I have an index with some fields like appId and responsetime. I also have a dataset where the appId is same, but in this file I have a propername linked with the appId

So as example
INDEX OUTPUT
appId, responsetime
202, 1200

OUTPUT file
appId, serviceName
202, serviceA

I am looking for a syntax where I can have the output:
serviceA, responseTime
202, 1200

And on top of this, I want to create a chart out of this.

I was playing around with a join query and was able to create a table

index=xx | dedup appId | eval duration = RT - FT | join type=inner appId
[|inputlookup tmpfile.csv | rename serviceA as URL]
| table appId serviceA responsetime
|where appId = appId

BUT, I can not create charts with avg(responseTime).

 

Can someone help?

 

Thanks.

Amit

Labels (2)
0 Karma

nadlurinadluri
Communicator

You dont need to use join here when the data is in lookup file and for charts you can use stats command , you can try something like below - 

$FirstQuery which gives appId and reponseTime as output$
| lookup tmpfile.csv appId AS appId output serviceA
| stats avg(responseTime) AS responseTime by appId,serviceA
0 Karma

AmitSampat
Loves-to-Learn Lots

Thank for the response.

 

I tried, but this is not working. Also I need to remove the dedup, otherwise it will take only one event.
The thing is de index output results in many appId's with some responsetime. I need to make this into a chart, linked with the servicename (which is not there in the index output).

 

Any tips how to proceed?

Thanks

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...