Splunk Search

Multiple Timecharts by a field in single search

nagpalga
Engager

I wanted to create multiple timecharts in a single search. The scenario i am stuck in is something like this :

index = "A" sourcetype = "B" | where Activity_type = "Activity1" | timechart span=10m count by Event_Type

There are multiple activity_type fields and i want multiple timecharts by Event_Type for different Activity_type in a single search.

Thanks in advance for your help.

Labels (1)

j0e3gan
Explorer

I would like to do the same in a dashboard if possible -- generate a timechart per host in the search results.  Might someone be able to provide some insight here, even point to similar question that has been answered?  Thanks.

0 Karma

tscroggins
Influencer

I've used the trellis option to achieve this. For example:

index=_internal sourcetype=splunkd source=*/splunkd.log*
| bin _time span=10m
| stats count(eval(case(log_level=="ERROR", log_level))) as ERROR count(eval(case(log_level=="WARN", log_level))) as WARN count(eval(case(log_level=="INFO", log_level))) as INFO by _time component

will produce a table of log_level counts by _time and component:

_timecomponentERRORWARNINFO
2021-02-20 11:00AdminManager010
...............

 

In the chart configuration, enable trellis and split by the desired field. I split by component in this example to display counts of events by log_level over time per component.

j0e3gan
Explorer

Trellis options give me a timechart per server using my browser, which is perfect.  Only downside for me is that PDF export does not support trellis options, but this is still a handy approach when PDF export is not a concern.  Thanks!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

In your dashboard, near the top of the simpleXML, you can have a base search

 

  <search id="base_search">
    <query>index = "A" sourcetype = "B" | timechart span=10m count by Activity_type, Event_Type</query>

 

Then in each dashboard panel, you set the query to be based on your base search with the additional where clause

 

      <chart>
        <search base="base_search">
          <query>| search "Activity1"</query>
        </search> 

 

 

j0e3gan
Explorer

In the dashboard where I tested your suggestion, a base search in the related panel followed by a post-process search in each of the panel's charts works well -- gives me a timechart per server both in my browser and PDF exports.  Only downside is having to know the number of servers to prepare a chart with a post-process search per server, which is not quite as clean as the trellis option mentioned that dynamically produces charts for n servers.  Still, compatibility with PDF exports requires tradeoffs with maintainability in my experience, so this solution is great when I need it.  Thanks!

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...