Splunk Search

Is there a way to display a timechart for all results of a search?

Engager

I'm trying to find a way to return a list of hosts and then create a timechart of a metric for each of the hosts. Below is the attempt I made using the map command, but only the final result seems to display.

index=nix | dedup host | table host | map [search index=nix sourcetype=cpu  host=$host$ cpu=All| eval pctCPU=(100 - pctIdle) | eventstats avg(pctCPU) as apctCPU, stdev(pctCPU) as sdev | eval threeSigma=(apctCPU + (sdev * 3)) | where pctCPU < threeSigma | timechart span=5m values(pctCPU)]
0 Karma

Revered Legend

How about this

index=nix sourcetype=cpu   cpu=All| eval pctCPU=(100 - pctIdle) | eventstats avg(pctCPU) as apctCPU, stdev(pctCPU) as sdev by host | eval threeSigma=(apctCPU + (sdev * 3)) | where pctCPU < threeSigma | timechart span=5m values(pctCPU) by host
0 Karma

Engager

No, that just gives one chart with all of the hosts on it. What I'm needing to satisfy the managers request is a page with one chart for each of the hosts from the fist search results. So if 5 hosts are returned, I need to create 5 graphs.

0 Karma

Revered Legend

You can run this query and in the dashboard->Edit Panel, select the Multi-series as Yes. This will give you one graph for each series (host). See this for more details
https://answers.splunk.com/answers/96358/multi-series-graph-split-by-group-clause.html

0 Karma

Engager

That is better. Not exactly what I was hoping for, but probably good enough for the time being. Thanks.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!