Splunk Search

Need to Create Two Time Series in One Chart

Splunk Employee
Splunk Employee

Answer below.

0 Karma

Splunk Employee
Splunk Employee

Credit to Dritan.

Plotting two time-series in one chart is a frequent ask from many of our customers. After several related questions/requests in chat and mailing lists I decided to create and share three macros to facilitate this. They draw two time-series graphs by using a single search while manipulating the _time field and then keying the series off of a new field. Of course, there are several ways to achieve this, as witnessed in Answers and elsewhere, so feel free to modify as necessary. But whatever smart changes and improvements you make (such as parametrize even further ex. the time range, the span etc), please share.


hour over hour compare, 1m span

args = search, measure
definition = $search$ earliest=-1h@h \
| bin span=1m _time\
| addinfo\
| eval marker = if(_time < info_min_time + 3600, "Last Hour", "Current Hour") \
| eval _time = if(_time < info_min_time + 3600, _time + 3600, _time) \
| chart $measure$ by _time marker
iseval = 0

day over day compare, 15m span

args = search, measure
definition = $search$ earliest=-1d@d \
| bin span=15m _time\
| addinfo\
| eval marker = if(_time < info_min_time + 24*3600, "Yesterday", "Today") \
| eval _time = if(_time < info_min_time + 24*3600, _time + 24*3600, _time) \
| chart $measure$ by _time marker
iseval = 0

week over week compare, 1h span

args = search, measure
definition = $search$ earliest=-1w@w\
| bin span=1h _time\
| addinfo\
| eval marker = if(_time < info_min_time + 7*24*3600, "Last Week", "Current Week") \
| eval _time = if(_time < info_min_time + 7*24*3600, _time + 7*24*3600, _time) \
| chart $measure$ by _time marker
iseval = 0

Sample Searches:

Event Count: Current Hour vs. Last Hour

twoseries_h("index=_internal", count)

Indexing Thruput: Today vs. Yesterday
twoseries_d("index=_internal group=per_index_thruput series=_internal", "avg(kbps)")

Started Searches: Current Week vs. Last Week
twoseries_w("index=_internal source=*metrics.log group=searchscheduler", "sum(dispatched)")

More info here:

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!