Splunk Search

Multiple fields in one chart

pudanelilita
Explorer

Hi,
I struggling to create chart, which will be with multiple field values (max,avg and min pauses) + need to see months (January, February, March etc.) in X-Axis

What I need to change here?
| eval fields=split(_raw," ")
| eval pauses=mvindex(fields,8)
| eventstats max(pauses) as Max_pause
| eventstats avg(pauses) as Avg_pause
| eventstats min(pauses) as Min_pause
| table Max_pause Avg_pause Min_pause

Tags (2)
0 Karma
1 Solution

whrg
Motivator

It would be helpful if you could post some sample data. Does your data have the _time field?

If you want a chart with time as the X-axis, then take a look at timechart.

Try something like this:

... | eval fields=split(_raw," ") | eval pauses=mvindex(fields,8) | timechart span=1mon max(pauses) as Max_pause avg(pauses) as Avg_pause min(pauses) as Min_pause

View solution in original post

0 Karma

whrg
Motivator

It would be helpful if you could post some sample data. Does your data have the _time field?

If you want a chart with time as the X-axis, then take a look at timechart.

Try something like this:

... | eval fields=split(_raw," ") | eval pauses=mvindex(fields,8) | timechart span=1mon max(pauses) as Max_pause avg(pauses) as Avg_pause min(pauses) as Min_pause

View solution in original post

0 Karma

pudanelilita
Explorer

It worked without span=1mon, thanks!

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!