Splunk Search

How to visually represent Session Creation trend across load balanced Java Virtual Machines (JVMs)?

psteja
Engager

Splunk newbie here trying to get a nice line graph showing the session creation pattern over a period of time:

.....|table sessionNum source _time |????????

Not sure what to put there so I get different colored lines one for each source, with NumberOfSessions per source over the time period. Thank you.

0 Karma
1 Solution

twinspop
Influencer

This will first get the earliest time a particular sessionNum was seen. Then it will chart the count of sessionNums over time by source.

... | stats min(_time) as _time by sessionNum, source | timechart count by source

EDIT: Based on comment below:

... | timechart sum(sessionNum) by source

View solution in original post

0 Karma

twinspop
Influencer

This will first get the earliest time a particular sessionNum was seen. Then it will chart the count of sessionNums over time by source.

... | stats min(_time) as _time by sessionNum, source | timechart count by source

EDIT: Based on comment below:

... | timechart sum(sessionNum) by source
0 Karma

psteja
Engager

Almost 🙂 In my case I shouldn't sum, I need to take max/min/avg to get the rough number of active sessions per source. thank you.

0 Karma

psteja
Engager

I guess I am not clear enough. my sessionNUm =Total number of sessions at that particular time on that source. So I can not 'count' again. my 'event' already has the sessionCount. Hope I am making sense. So for a given source , I can have sessionNum 10,11,12,13,12,11,12,13,14,.... etc. And I want to represent it visually

0 Karma

twinspop
Influencer

See edit above

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi psteja,
if you want to draw a graphic, you cannot use the table command, but you have to use a statistical command like stats, charts or timechart.
so you could use:

your_search |timechart count by sessionNum

to have a time distribution of your events
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...