Splunk Search

Multiple Series Line Chart Dashboard

Explorer

Hi everyone!

I'm trying to add a new series to my line chart from my dashboard's xml file. (Which means I want to display 2 lines on my chart).

So far I have the following:

<?xml version='1.0' encoding='utf-8'?>
<dashboard>
  <!--
NOTE: This file was automatically generated by Splunk.  Use caution when editing manually.
-->
  <label>SLU CPU PERFORMANCE</label>
  <row>
    <chart>
      <option name="charting.chart">line</option>
      <searchString>source="*slu*" CPU_IDLE_USAGE="*" | timechart max(CPU_IDLE_USAGE)</searchString>
      <title>CPU PERFORMANCE</title>
      <option name="drilldown">all</option>
    </chart>
  </row>
  <row>
    <table>
      <searchString>source="*slu*" CPU_IDLE_USAGE="*"</searchString>
      <title>Results</title>
      <option name="drilldown">row</option>
    </table>
  </row>
</dashboard>

... and I would like to add the CPU_SYS_USAGE="*" field as a series to this chart.

Thank you in advance.

Bye!

Tags (2)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

I suppose all you should need to do is use:

source=*slu* | timechart max(CPU_IDLE_USAGE) max(CPU_SYS_USAGE)

(or average(CPU_SYS_USAGE) or some other aggregator function besides max() if you prefer).

View solution in original post

Explorer

Use max() and set the span to be lower than the time between data points so you only capture one data point in a span.

Explorer

Thanks!

Now, what if I don't want to plot a max() or an avg()?

I just want to show the numbers that CPU_IDLE_USAGE have. For example:

_time              CPU_ID CPU_IDLE_USAGE 
8/23/10 11:25:00.000 PM 0 90 
8/23/10 11:20:00.000 PM 0 83 
8/23/10 11:15:00.000 PM 0 81 
8/23/10 11:10:00.000 PM 0 82 
8/23/10 11:05:00.000 PM 0 88 
8/23/10 11:00:00.000 PM 0 78 

I would like to plot the following values: 90, 83, 81, 82, 88... etc. How can I do that?

Thank you again

0 Karma

Splunk Employee
Splunk Employee

I suppose all you should need to do is use:

source=*slu* | timechart max(CPU_IDLE_USAGE) max(CPU_SYS_USAGE)

(or average(CPU_SYS_USAGE) or some other aggregator function besides max() if you prefer).

View solution in original post

Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!