Splunk Search

How to get a timechart for two values, but not sort by the split-by field alphabetically?

Skamensky
Engager

I'm trying to plot to two separate values against another value like this

timechart avg(x) avg(y) by z

And I want to limit the results to the top 5 values. The problem comes in when I use limit to achieve this. It will score z in alphabetical order (each field value z occurs the same amount of times as the rest). How can I get a timechart of these two values, limited to only the z values that have the greatest, x, y values?

0 Karma
1 Solution

sundareshr
Legend

Try this

... |  bin _time as time | stats avg(bytes) as x avg(spent) as y by time z | sort z x y | streamstats window=6 count by z x y | where count<6 | chart values(x) as x values(y) as y over time by z  | eval time=strftime(time, "%x %X")

View solution in original post

sundareshr
Legend

Try this

... |  bin _time as time | stats avg(bytes) as x avg(spent) as y by time z | sort z x y | streamstats window=6 count by z x y | where count<6 | chart values(x) as x values(y) as y over time by z  | eval time=strftime(time, "%x %X")

martin_mueller
SplunkTrust
SplunkTrust

Please give an example of what your desired result looks like and how that differs from timechart's default behaviour.

0 Karma

Skamensky
Engager

For instance let say foo and bar have the highest values of x. I want to create a timechart of values x and y by z and I want to display the ones with top value.

If I do Timechart x y by z limit=x it will instead return the z values that are first alphabetically and not ones that have highest x values.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...