Splunk Search

How to create graphs for two different values of same field?

bullriser
New Member

Hello, i have a splunk query like this 

index=someindex container_name=app ( cookie=*cookie1" OR cookie="cookie2" ) event=Someevent  | timechart span=1m perc50(latency)

This above query will create one line chart. how can we create two charts one for cookie=cookie1 and the other for cookie=cookie2 in same panel ?

Thanks in advance

Labels (3)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

That's a simple split by clause with a bit of handling for the wildcard case cookie1

 

index=someindex container_name=app ( cookie=*cookie1" OR cookie="cookie2" ) event=Someevent
| rex field=cookie "(?<cookieType>cookie\d)"
| timechart span=1m perc50(latency) by cookieType

 

The rex statement is looking for the 'cookieX' where X is a digit and creating a new field called cookieType containing either cookie1 or cookie2 and then the by clause will split the result into the two lines on the chart.

If you actually want two charts in the same panel, then select the 'trellis' mode and choose the aggregation, which will give you two separate charts in a panel, with the cookieType on each chart. If you just want two lines in the same chart, ignore the trellis mode

Hope this helps

 

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...