Splunk Search

Show increasing values with dropoff

Engager

I have a data set similar to the following:

"_time",source,increment
"2020-02-26","third",
"2020-02-25","third","yes"
"2020-02-21","third",
"2020-02-20","third","yes"
"2020-02-29","second",
"2020-02-28","second","yes"
"2020-02-27","second","yes"
"2020-02-26","second","yes"
"2020-02-25","second","yes"
"2020-02-24","second","yes"
"2020-02-23","second","yes"
"2020-02-22","second","yes"
"2020-03-01","first",
"2020-02-29","first","yes"

I would like to make this chart with first=blue, second=red, and third=green:
alt text

So for each yes in the increment column add 1 to the current count for the source, else reset the count back to 0. If a source does not have a reset column it should continue at the current count to the end of the chart.

Is this possible?

0 Karma
1 Solution

Influencer

Hi @jlieberg,

Yes, this is possible with below query:

| makeresults 
| eval _raw="time,source,increment
2020-02-26,third,
2020-02-25,third,yes
2020-02-21,third,
2020-02-20,third,yes
2020-02-29,second,
2020-02-28,second,yes
2020-02-27,second,yes
2020-02-26,second,yes
2020-02-25,second,yes
2020-02-24,second,yes
2020-02-23,second,yes
2020-02-22,second,yes
2020-03-01,first,
2020-02-29,first,yes" 
| multikv forceheader=1 
| sort source, time 
| streamstats count(increment) as step by source reset_after="("isnull(increment)")" 
| eval step=if(increment=="yes", step, 0) 
| xyseries time source step

Once you run the search, go to Visualization tab and select Column Chart.

alt text

In your search query you can add this:

| eval time=strftime(_time, "%y-%m-%d")
| sort source, time 
| streamstats count(increment) as step by source reset_after="("isnull(increment)")" 
| eval step=if(increment=="yes", step, 0) 
| xyseries time source step

View solution in original post

Influencer

Hi @jlieberg,

Yes, this is possible with below query:

| makeresults 
| eval _raw="time,source,increment
2020-02-26,third,
2020-02-25,third,yes
2020-02-21,third,
2020-02-20,third,yes
2020-02-29,second,
2020-02-28,second,yes
2020-02-27,second,yes
2020-02-26,second,yes
2020-02-25,second,yes
2020-02-24,second,yes
2020-02-23,second,yes
2020-02-22,second,yes
2020-03-01,first,
2020-02-29,first,yes" 
| multikv forceheader=1 
| sort source, time 
| streamstats count(increment) as step by source reset_after="("isnull(increment)")" 
| eval step=if(increment=="yes", step, 0) 
| xyseries time source step

Once you run the search, go to Visualization tab and select Column Chart.

alt text

In your search query you can add this:

| eval time=strftime(_time, "%y-%m-%d")
| sort source, time 
| streamstats count(increment) as step by source reset_after="("isnull(increment)")" 
| eval step=if(increment=="yes", step, 0) 
| xyseries time source step

View solution in original post

Engager

Wow, that is really cool! I did change increment=="yes" to !isnull(increment) to be more flexible, but this is a cool solution that I figured had to be possible. My actual date ranges are longer than in this example, and I was hoping I could use some kind of "stepped" area chart that didn't interpolate between points, do you know if that is possible?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!