Splunk Search

Plot Avg, Std Dev and Data on the same Chart


I realize there are a number of ways to approach putting multiple values in a time chart, but I'm not sure how best to go about this in Splunk. In R or matplotlib, it's pretty easy -- you establish your figure, then add components to it and tweak those components as necessary. In Splunk, nearly everything is instantiated using eval, which is confusing and serial. What I'm trying to do is simple:

For a given data set, split the data set by a couple of fields, calculate the mean and standard deviation from the mean for an arbitrary time span (say, 15 days before the data point being plotted) and plot all 3 on one graph.

The attached image is similar to what I'm looking for, but I'm having a hard time figuring out how to do this without using trendlines.


Splunk Employee
Splunk Employee

If you want multiple values plotted in the line chart, specify multiple functions for the time chart.

Try this:

index=_internal group=pipeline name=indexerpipe processor=indexer| timechart mean(write_cpu_seconds) as mean stdev(write_cpu_seconds) as stdev perc95(write_cpu_seconds) as perc95


It's probably entirely different from what you're trying to do, but give this a shot:

sourcetype=farequote airline=AAL | timechart bins=250 avg(responsetime) as responsetime | predict responsetime
0 Karma
Get Updates on the Splunk Community!

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Tips & Tricks When Using Ingest Actions

Tune in to learn about:Large scale architecture when using Ingest ActionsRegEx performance considerations ...