Splunk Search

Need to Create Two Time Series in One Chart

msettipane
Splunk Employee
Splunk Employee

Answer below.

0 Karma

msettipane
Splunk Employee
Splunk Employee

Credit to Dritan.

Plotting two time-series in one chart is a frequent ask from many of our customers. After several related questions/requests in chat and mailing lists I decided to create and share three macros to facilitate this. They draw two time-series graphs by using a single search while manipulating the _time field and then keying the series off of a new field. Of course, there are several ways to achieve this, as witnessed in Answers and elsewhere, so feel free to modify as necessary. But whatever smart changes and improvements you make (such as parametrize even further ex. the time range, the span etc), please share.

macros.conf

hour over hour compare, 1m span

[twoseries_h(2)]
args = search, measure
definition = $search$ earliest=-1h@h \
| bin span=1m _time\
| addinfo\
| eval marker = if(_time < info_min_time + 3600, "Last Hour", "Current Hour") \
| eval _time = if(_time < info_min_time + 3600, _time + 3600, _time) \
| chart $measure$ by _time marker
iseval = 0

day over day compare, 15m span

[twoseries_d(2)]
args = search, measure
definition = $search$ earliest=-1d@d \
| bin span=15m _time\
| addinfo\
| eval marker = if(_time < info_min_time + 24*3600, "Yesterday", "Today") \
| eval _time = if(_time < info_min_time + 24*3600, _time + 24*3600, _time) \
| chart $measure$ by _time marker
iseval = 0

week over week compare, 1h span

[twoseries_w(2)]
args = search, measure
definition = $search$ earliest=-1w@w\
| bin span=1h _time\
| addinfo\
| eval marker = if(_time < info_min_time + 7*24*3600, "Last Week", "Current Week") \
| eval _time = if(_time < info_min_time + 7*24*3600, _time + 7*24*3600, _time) \
| chart $measure$ by _time marker
iseval = 0

Sample Searches:

Event Count: Current Hour vs. Last Hour

twoseries_h("index=_internal", count)

Indexing Thruput: Today vs. Yesterday
twoseries_d("index=_internal group=per_index_thruput series=_internal", "avg(kbps)")

Started Searches: Current Week vs. Last Week
twoseries_w("index=_internal source=*metrics.log group=searchscheduler", "sum(dispatched)")

More info here:
http://blogs.splunk.com/2012/02/19/compare-two-time-ranges-in-one-report/
http://splunk-base.splunk.com/answers/11350/2-searches-1-chart
http://splunk-base.splunk.com/answers/23345/2-searches-1-graph
http://splunk-base.splunk.com/answers/2712/line-chart-comparing-yesterdays-result-with-todays-result...

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...