Splunk Search

How to draw multiple line using chart over date.

royimad
Builder

I'm trying to draw a chart using multiple line for each DeviceSubType without using timechart , i need to use chart over date.

The code:


Last 24 hours

sourcetype="DevicesReads" | eval devices_collection_date=collection_date | eval onlinereads=NbrOnlineReads | fields DEVICE_ID, onlinereads , devices_collection_date
| JOIN type=left DEVICE_ID
[ search sourcetype="DevicesInfo" $locations$ AND $series$
| fields DEVICE_ID, ExpectedNumberOfReadsPerDay, DeviceSubType, collection_date ]
| table DEVICE_ID, Location, DeviceSubType, ExpectedNumberOfReadsPerDay, onlinereads, collection_date, devices_collection_date
| eval Uptime=if(onlinereads>ExpectedNumberOfReadsPerDay,1,onlinereads/ExpectedNumberOfReadsPerDay) | eval time=strptime(devices_collection_date,"%Y%m%d") | convert TIMEFORMAT="%Y-%m-%d" ctime(time) AS date
| chart eval(avg(Uptime)*100) over date BY DeviceSubType

               <module name="HiddenChartFormatter">
                    <param name="chart">line</param>
                    <param name="chart.nullValueMode">zero</param>
                    <param name="primaryAxisTitle.text">Time</param>
                    <param name="secondaryAxisTitle.text">Uptime Reports</param>
                    <module name="JobProgressIndicator"/>
                    <module name="FlashChart">
                      <param name="width">100%</param>
                      <param name="height">200px</param>
                    </module>
                  </module>

      </module>
Tags (3)
0 Karma
1 Solution

royimad
Builder

This is resolved with the following peace of cake:

| chart eval(avg(Uptime)*100) over date BY DeviceSubType

Chart showing uptime of different devices series
line
zero
Time
Series Uptime


100%
400px

View solution in original post

0 Karma

royimad
Builder

This is resolved with the following peace of cake:

| chart eval(avg(Uptime)*100) over date BY DeviceSubType

Chart showing uptime of different devices series
line
zero
Time
Series Uptime


100%
400px

0 Karma
Get Updates on the Splunk Community!

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...