Splunk Search

How to write a search for a multikv timechart?

sonicZ
Contributor

I have a chart command i've been gathering all the netstat values for a single hour

index=os host=ship*  starttime=10/01/2014:19:00:00 endtime=10/01/2014:19:20:00 sourcetype=netstat | multikv fields State AS netstat_states |  chart count by State, host

Trying to get the equivalent timechart values so I can see when certain states occurred.
here's what i have so far but does not get the actual netstat states, just the count. Looking to get the actual netstat values captured in the timechart as well.

index=os host=ship* sourcetype=netstat | multikv fields State as netstat_states |  timechart span=1h count(netstat_states) by host
Tags (2)
1 Solution

lguinn2
Legend

Try this...

index=os host=ship*  starttime=10/01/2014:19:00:00 endtime=10/01/2014:19:20:00 sourcetype=netstat 
| multikv fields State AS netstat_states 
| eval State_host = State . "+" . host 
| timechart count by State_host

View solution in original post

lguinn2
Legend

Try this...

index=os host=ship*  starttime=10/01/2014:19:00:00 endtime=10/01/2014:19:20:00 sourcetype=netstat 
| multikv fields State AS netstat_states 
| eval State_host = State . "+" . host 
| timechart count by State_host

sonicZ
Contributor

That was it, will be very useful for timecharting other multikv stats, I had to use a limit=0 but got what i needed with your search. Thanks

0 Karma
Get Updates on the Splunk Community!

Message Parsing in SOCK

Introduction This blog post is part of an ongoing series on SOCK enablement. In this blog post, I will write ...

Exploring the OpenTelemetry Collector’s Kubernetes annotation-based discovery

We’ve already explored a few topics around observability in a Kubernetes environment -- Common Failures in a ...

Use ‘em or lose ‘em | Splunk training units do expire

Whether it’s hummus, a ham sandwich, or a human, almost everything in this world has an expiration date. And, ...