Splunk Search

Show increasing values with dropoff

jlieberg
Engager

I have a data set similar to the following:

"_time",source,increment
"2020-02-26","third",
"2020-02-25","third","yes"
"2020-02-21","third",
"2020-02-20","third","yes"
"2020-02-29","second",
"2020-02-28","second","yes"
"2020-02-27","second","yes"
"2020-02-26","second","yes"
"2020-02-25","second","yes"
"2020-02-24","second","yes"
"2020-02-23","second","yes"
"2020-02-22","second","yes"
"2020-03-01","first",
"2020-02-29","first","yes"

I would like to make this chart with first=blue, second=red, and third=green:
alt text

So for each yes in the increment column add 1 to the current count for the source, else reset the count back to 0. If a source does not have a reset column it should continue at the current count to the end of the chart.

Is this possible?

0 Karma
1 Solution

manjunathmeti
SplunkTrust
SplunkTrust

Hi @jlieberg,

Yes, this is possible with below query:

| makeresults 
| eval _raw="time,source,increment
2020-02-26,third,
2020-02-25,third,yes
2020-02-21,third,
2020-02-20,third,yes
2020-02-29,second,
2020-02-28,second,yes
2020-02-27,second,yes
2020-02-26,second,yes
2020-02-25,second,yes
2020-02-24,second,yes
2020-02-23,second,yes
2020-02-22,second,yes
2020-03-01,first,
2020-02-29,first,yes" 
| multikv forceheader=1 
| sort source, time 
| streamstats count(increment) as step by source reset_after="("isnull(increment)")" 
| eval step=if(increment=="yes", step, 0) 
| xyseries time source step

Once you run the search, go to Visualization tab and select Column Chart.

alt text

In your search query you can add this:

| eval time=strftime(_time, "%y-%m-%d")
| sort source, time 
| streamstats count(increment) as step by source reset_after="("isnull(increment)")" 
| eval step=if(increment=="yes", step, 0) 
| xyseries time source step

View solution in original post

manjunathmeti
SplunkTrust
SplunkTrust

Hi @jlieberg,

Yes, this is possible with below query:

| makeresults 
| eval _raw="time,source,increment
2020-02-26,third,
2020-02-25,third,yes
2020-02-21,third,
2020-02-20,third,yes
2020-02-29,second,
2020-02-28,second,yes
2020-02-27,second,yes
2020-02-26,second,yes
2020-02-25,second,yes
2020-02-24,second,yes
2020-02-23,second,yes
2020-02-22,second,yes
2020-03-01,first,
2020-02-29,first,yes" 
| multikv forceheader=1 
| sort source, time 
| streamstats count(increment) as step by source reset_after="("isnull(increment)")" 
| eval step=if(increment=="yes", step, 0) 
| xyseries time source step

Once you run the search, go to Visualization tab and select Column Chart.

alt text

In your search query you can add this:

| eval time=strftime(_time, "%y-%m-%d")
| sort source, time 
| streamstats count(increment) as step by source reset_after="("isnull(increment)")" 
| eval step=if(increment=="yes", step, 0) 
| xyseries time source step

jlieberg
Engager

Wow, that is really cool! I did change increment=="yes" to !isnull(increment) to be more flexible, but this is a cool solution that I figured had to be possible. My actual date ranges are longer than in this example, and I was hoping I could use some kind of "stepped" area chart that didn't interpolate between points, do you know if that is possible?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...