Splunk Search

Perfmon Timechart - Multiple Series, Multiple Host

Path Finder

I have been struggling to find the proper syntax for this type of timechart. This relates to creating a Windows PerfMon graph for multiple series (in the same counter) and multiple host to be able to easily compare. For example, I can graph Bytes Received/sec and Bytes Sent/sec with a simple search like:

index=MyIndex object="Network Interface" | timechart span=30min avg(Value) by counter

This provides gives the total for both host. Now I want to essentially add by host to the end of by counter. Any thoughts? Is this a multi-valued field???

Tags (2)
0 Karma

Revered Legend

Give this a try

index=MyIndex object="Network Interface" |bucket _time span=30m | eval host=_time."##".host|chart avg(Value) over host by counter | rex field=host "(?<_time>.*)##(?<host>.*)"
0 Karma


Try Chart instead of timechart

|bucket _time span=30m|chart avg(Value) by _time,counter,host

|bucket _time span=30m|chart avg(Value) over host by counter

have not tried it myself but this is the way to go. Check out chart overlay in the documentation


0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!