Splunk Search

Need another column in chart

tsheets13
Communicator

Forgive my newbiness. I've been working with Splunk for many years but not developing reports. I have a report that works well. After the search criteria and all are completed, the following shows the report...

timechart span=30m max(ms) as MS, by server
| eval Time=strftime(_time,"%H:%M:%S %m/%d/%Y")
| untable Time, server, ms
| sort +Time

I got Time and server and ms columns beautifully.

However, there is a field called APP that I would like to also display a column for. How can I get the report to included this column?

0 Karma

jpolvino
Builder

If your events have many values for APP, then what kind of statistical function would you apply in the timechart command to render a useful value in your chart? Suppose you have 2 hosts for every 30 minutes, your table would have a rows that look like:
timestamp00,host1,MS1
timestamp00,host2,MS2
timestamp30,host1,MS3
timestamp30,host2,MS4
...

Is APP static value you just want tacked on the right side?

0 Karma

tsheets13
Communicator

Early in the search we do a lookup

lookup TimeServersV2.csv server as server OUTPUT "type" as type APP as APP

type is used as part of the search succesfully, but if I add either APP or type to the untable command, it complains "The argument 'type' is invalid.

0 Karma
Get Updates on the Splunk Community!

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...