Splunk Search

How to draw multiple line using chart over date.

royimad
Builder

I'm trying to draw a chart using multiple line for each DeviceSubType without using timechart , i need to use chart over date.

The code:


Last 24 hours

sourcetype="DevicesReads" | eval devices_collection_date=collection_date | eval onlinereads=NbrOnlineReads | fields DEVICE_ID, onlinereads , devices_collection_date
| JOIN type=left DEVICE_ID
[ search sourcetype="DevicesInfo" $locations$ AND $series$
| fields DEVICE_ID, ExpectedNumberOfReadsPerDay, DeviceSubType, collection_date ]
| table DEVICE_ID, Location, DeviceSubType, ExpectedNumberOfReadsPerDay, onlinereads, collection_date, devices_collection_date
| eval Uptime=if(onlinereads>ExpectedNumberOfReadsPerDay,1,onlinereads/ExpectedNumberOfReadsPerDay) | eval time=strptime(devices_collection_date,"%Y%m%d") | convert TIMEFORMAT="%Y-%m-%d" ctime(time) AS date
| chart eval(avg(Uptime)*100) over date BY DeviceSubType

               <module name="HiddenChartFormatter">
                    <param name="chart">line</param>
                    <param name="chart.nullValueMode">zero</param>
                    <param name="primaryAxisTitle.text">Time</param>
                    <param name="secondaryAxisTitle.text">Uptime Reports</param>
                    <module name="JobProgressIndicator"/>
                    <module name="FlashChart">
                      <param name="width">100%</param>
                      <param name="height">200px</param>
                    </module>
                  </module>

      </module>
Tags (3)
0 Karma
1 Solution

royimad
Builder

This is resolved with the following peace of cake:

| chart eval(avg(Uptime)*100) over date BY DeviceSubType

Chart showing uptime of different devices series
line
zero
Time
Series Uptime


100%
400px

View solution in original post

0 Karma

royimad
Builder

This is resolved with the following peace of cake:

| chart eval(avg(Uptime)*100) over date BY DeviceSubType

Chart showing uptime of different devices series
line
zero
Time
Series Uptime


100%
400px

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

In cybersecurity, defenders respond to threats. Architects design the systems that stop them.    As ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...