Splunk Search
Highlighted

Plot Avg, Std Dev and Data on the same Chart

Communicator

Hi,
I realize there are a number of ways to approach putting multiple values in a time chart, but I'm not sure how best to go about this in Splunk. In R or matplotlib, it's pretty easy -- you establish your figure, then add components to it and tweak those components as necessary. In Splunk, nearly everything is instantiated using eval, which is confusing and serial. What I'm trying to do is simple:

For a given data set, split the data set by a couple of fields, calculate the mean and standard deviation from the mean for an arbitrary time span (say, 15 days before the data point being plotted) and plot all 3 on one graph.

The attached image is similar to what I'm looking for, but I'm having a hard time figuring out how to do this without using trendlines.

Plotzilla

Highlighted

Re: Plot Avg, Std Dev and Data on the same Chart

SplunkTrust
SplunkTrust

It's probably entirely different from what you're trying to do, but give this a shot:

sourcetype=farequote airline=AAL | timechart bins=250 avg(responsetime) as responsetime | predict responsetime
0 Karma
Highlighted

Re: Plot Avg, Std Dev and Data on the same Chart

Splunk Employee
Splunk Employee

If you want multiple values plotted in the line chart, specify multiple functions for the time chart.

Try this:

index=internal group=pipeline name=indexerpipe processor=indexer| timechart mean(writecpuseconds) as mean stdev(writecpuseconds) as stdev perc95(writecpu_seconds) as perc95