Splunk Search

Need another column in chart

tsheets13
Communicator

Forgive my newbiness. I've been working with Splunk for many years but not developing reports. I have a report that works well. After the search criteria and all are completed, the following shows the report...

timechart span=30m max(ms) as MS, by server
| eval Time=strftime(_time,"%H:%M:%S %m/%d/%Y")
| untable Time, server, ms
| sort +Time

I got Time and server and ms columns beautifully.

However, there is a field called APP that I would like to also display a column for. How can I get the report to included this column?

0 Karma

jpolvino
Builder

If your events have many values for APP, then what kind of statistical function would you apply in the timechart command to render a useful value in your chart? Suppose you have 2 hosts for every 30 minutes, your table would have a rows that look like:
timestamp00,host1,MS1
timestamp00,host2,MS2
timestamp30,host1,MS3
timestamp30,host2,MS4
...

Is APP static value you just want tacked on the right side?

0 Karma

tsheets13
Communicator

Early in the search we do a lookup

lookup TimeServersV2.csv server as server OUTPUT "type" as type APP as APP

type is used as part of the search succesfully, but if I add either APP or type to the untable command, it complains "The argument 'type' is invalid.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...