Splunk Search
Highlighted

How to draw multiple line using chart over date.

Builder

I'm trying to draw a chart using multiple line for each DeviceSubType without using timechart , i need to use chart over date.

The code:


Last 24 hours

sourcetype="DevicesReads" | eval devicescollectiondate=collectiondate | eval onlinereads=NbrOnlineReads | fields DEVICEID, onlinereads , devicescollectiondate
| JOIN type=left DEVICEID
[ search sourcetype="DevicesInfo" $locations$ AND $series$
| fields DEVICE
ID, ExpectedNumberOfReadsPerDay, DeviceSubType, collectiondate ]
| table DEVICE
ID, Location, DeviceSubType, ExpectedNumberOfReadsPerDay, onlinereads, collectiondate, devicescollectiondate
| eval Uptime=if(onlinereads>ExpectedNumberOfReadsPerDay,1,onlinereads/ExpectedNumberOfReadsPerDay) | eval time=strptime(devices
collection_date,"%Y%m%d") | convert TIMEFORMAT="%Y-%m-%d" ctime(time) AS date
| chart eval(avg(Uptime)*100) over date BY DeviceSubType

               <module name="HiddenChartFormatter">
                    <param name="chart">line</param>
                    <param name="chart.nullValueMode">zero</param>
                    <param name="primaryAxisTitle.text">Time</param>
                    <param name="secondaryAxisTitle.text">Uptime Reports</param>
                    <module name="JobProgressIndicator"/>
                    <module name="FlashChart">
                      <param name="width">100%</param>
                      <param name="height">200px</param>
                    </module>
                  </module>

      </module>
Tags (3)
0 Karma
Highlighted

Re: How to draw multiple line using chart over date.

Builder

This is resolved with the following peace of cake:

| chart eval(avg(Uptime)*100) over date BY DeviceSubType

Chart showing uptime of different devices series
line
zero
Time
Series Uptime


100%
400px

View solution in original post

0 Karma