Splunk Search
Highlighted

Splunk Employee

Tags (3)
Highlighted

Re: Need to Create Two Time Series in One Chart

Splunk Employee

Credit to Dritan.

Plotting two time-series in one chart is a frequent ask from many of our customers. After several related questions/requests in chat and mailing lists I decided to create and share three macros to facilitate this. They draw two time-series graphs by using a single search while manipulating the _time field and then keying the series off of a new field. Of course, there are several ways to achieve this, as witnessed in Answers and elsewhere, so feel free to modify as necessary. But whatever smart changes and improvements you make (such as parametrize even further ex. the time range, the span etc), please share.

hour over hour compare, 1m span

[twoseriesh(2)]
args = search, measure
definition = \$search\$ earliest=-1h@h \
| bin span=1m _time\
| eval marker = if(
time < infomintime + 3600, "Last Hour", "Current Hour") \
| eval time = if(time < infomintime + 3600, _time + 3600, _time) \
| chart \$measure\$ by _time marker
iseval = 0

day over day compare, 15m span

[twoseriesd(2)]
args = search, measure
definition = \$search\$ earliest=-1d@d \
| bin span=15m _time\
| eval marker = if(
time < infomintime + 243600, "Yesterday", "Today") \
| eval time = if(time < infomintime + 24
3600, _time + 24*3600, _time) \
| chart \$measure\$ by _time marker
iseval = 0

week over week compare, 1h span

[twoseriesw(2)]
args = search, measure
definition = \$search\$ earliest=-1w@w\
| bin span=1h _time\
| eval marker = if(
time < infomintime + 7243600, "Last Week", "Current Week") \
| eval time = if(time < infomintime + 7243600, _time + 7243600, _time) \
| chart \$measure\$ by _time marker
iseval = 0

Sample Searches:

Event Count: Current Hour vs. Last Hour

`twoseries_h("index=_internal", count)`

Indexing Thruput: Today vs. Yesterday
`twoseries_d("index=_internal group=per_index_thruput series=_internal", "avg(kbps)")`

Started Searches: Current Week vs. Last Week
`twoseries_w("index=_internal source=*metrics.log group=searchscheduler", "sum(dispatched)")`