Splunk Search
Highlighted

How to graph only a certain column of timechart?

Explorer

I'm still a noob to writing splunk searches so please bear with me. 🙂

I have a search that's currently generating 3 columns - but I really just want the last bit (which is the post calculation percentage). I believe I'm going about this completely wrong, as I think I should be doing calculation first, then the timechart at the end.

I was hoping someone could take a look at my existing search statement(s) and help fix it.

search:

index="httpindex" csuri="http://foo.bar"
| timechart span=1h count(eval(scachestatus="CACHEMISS" OR scachestatus="CACHEREVALIDATEDMISS")) AS cachemiss, count(eval(scachestatus="CACHEHIT" OR scachestatus="CACHEREVALIDATEDHIT" OR scachestatus="CACHEMEMHIT" OR scachestatus="CACHEREVALIDATEDMEMHIT")) as cachehit
| eval cache
hitratio=(100*cachehit/(cachehit+cachemiss))

So, this plots down the 3 numbers: cachehit, cachemiss, and the calculated ratio percentage between the two. All I want to chart in the timechart is the ratio%. Help? 🙂

0 Karma
Highlighted

Re: How to graph only a certain column of timechart?

Explorer

Might have solved it myself:

index="httpindex" csuri="http://foo.bar"
| timechart span=1h count(eval(scachestatus="CACHEMISS" OR scachestatus="CACHEREVALIDATEDMISS")) AS cachemiss, count(eval(scachestatus="CACHEHIT" OR scachestatus="CACHEREVALIDATEDHIT" OR scachestatus="CACHEMEMHIT" OR scachestatus="CACHEREVALIDATEDMEMHIT")) as cachehit
| eval cache
hitratio=(100*cachehit/(cachehit+cachemiss))
| timechart span=1h perhour(cachehit_ratio)

Seems to be generating kind of what I want...just going to confirm the #s are right using the per_hour func. 😛

0 Karma
Highlighted

Re: How to graph only a certain column of timechart?

Explorer

looks like this did it:

index="httpindex" csuri="http://foo.bar" | timechart span=1h count(eval(scachestatus="CACHEMISS" OR scachestatus="CACHEREVALIDATEDMISS")) AS cachemiss, count(eval(scachestatus="CACHEHIT" OR scachestatus="CACHEREVALIDATEDHIT" OR scachestatus="CACHEMEMHIT" OR scachestatus="CACHEREVALIDATEDMEMHIT")) as cachehit | eval cachehitratio=(100*cachehit/(cachehit+cachemiss)) | timechart span=1h perhour(cachehit_ratio)

Highlighted

Re: How to graph only a certain column of timechart?

Explorer

If anyone has a more efficient way to this, please please post 🙂

0 Karma