Splunk Search

How to create a timechart with actual values instead of some function of the actual values (such as sum, avg) etc?

gb0143
New Member

I have a splunk query of the following:

<searc> | timechart avg(cache_size) by host_instance

That will give me the average cache size per day. However I want to use the time metric for the log to visualize how much of each "host_instance" cache is being used at a certain time. Ideally I would l like to look at this chart and see how much cache was used by instance "a" (and all other instances) at a certain time.

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Adjust the timespan. 1h, 30m, 15m should be viable ...

  your search  | timechart span=1h avg(cache_size) by host_instance
0 Karma

somesoni2
Revered Legend

Charts have limits on how many points they can show, that's why it advisable to use an aggregation command to reduce the number of points plotted (see this for limits: http://docs.splunk.com/Documentation/SplunkCloud/6.6.1/Viz/ChartDisplayissues#Searches_with_non-tran...). You may be able to avoid using aggregation command and using just simple table command to show all points. How many events you've with our base search ?

0 Karma

cmerriman
Super Champion

would values(cache_size) or list(cache_size) be what you are looking for? or perhaps |bucket _time span=1d |table _time host_instance cache_size but bucket by 1d, 1h, etc., depending on what you need

otherwise, if you could more clearly define the expected output, that would be very helpful

Richfez
SplunkTrust
SplunkTrust

Also, if you could maybe mock up what that shows that isn't what you need, and what you'd like instead?

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!