Splunk Search

Simple question about timecharts

nebel
Communicator

Hi there,

I have a field with values, like 2, 4 or 10.
Now I want to use a timechart or a chart which display 2, 4 or 10 in a graph over the time. I struggeling because Splunk always use the event and not the content of the event.

when I perform a search like this

index=firewall | sourcetype=cisco | multikv fields connections | timechart avg(connections) by node

I just get average values of the connections - I want to use the real values in the field connections without using any mathematical constructions.

Thanks in advance

Cheers

Tags (1)
1 Solution

Ayn
Legend

Some explanation on how timechart behaves: timechart needs some kind of statistical function that returns a unique value for the timespan it's operating on. If you don't define the timespan yourself it will be set dynamically depending on what timerange the whole search spans, but let's take an example where the timespan is 1 minute and that somewhere in your log you have 3 of these events occurring within 1 minute. Splunk needs to know how to give you ONE value for "Value", even though there are 3 values of each. You can tell Splunk to just give you an average from the 3 events using the stats function avg, like you have done:

... | timechart span=1m avg(connections) by node

Or, if you only want the values from the first of the events within the time period, use first instead of avg. Want the sum? Use sum. And so on. More information on statistical functions is available here: http://www.splunk.com/base/Documentation/latest/SearchReference/Stats

There's also a second way to do this, which is to produce a table containing timestamps and values yourself and then feed them into the chart.

... | table _time connections

View solution in original post

colinmchugo
Explorer

Hi

I have panels that produce a number using the stat command (stats count | where count=0] | stats count) at the end of each panels calculations with a field that ensures not n/a. What i want to do is show the trend of this number over the last 24 hours or week. I was considering using trend lines but this may work better.

So i need some formula that calculates the number of events from a previous 24 hours i am guessing the avg command and then compares this to current day so i want to see the trends but also want to know if and when this log is not working for some reason. thanks C.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This question is more than 5 years old and has an accepted answer so you're unlikely to get an answer. You should post a new question.

---
If this reply helps you, Karma would be appreciated.
0 Karma

colinmchugo
Explorer

thanks Rich i tried that and nobody answered but ill try again thanks.

0 Karma

nebel
Communicator

I think we have a misunderstanding I want to know how I can use the values IN the field. for instance, connections=2 at 3 pm and connections=8 at 4 pm. So I want to have a graph which displays once the connections 2 and 8 over the time 3 and 4 pm.

For me it is important to display the real numbers in my time chart without having avg etc.
I don't need it in a table.

You know what I mean?

0 Karma

Ayn
Legend

I know, and that's the problem I'm addressing in my answer. There are two suggested ways of solving it in there - what are your objections to either way?

0 Karma

Ayn
Legend

Some explanation on how timechart behaves: timechart needs some kind of statistical function that returns a unique value for the timespan it's operating on. If you don't define the timespan yourself it will be set dynamically depending on what timerange the whole search spans, but let's take an example where the timespan is 1 minute and that somewhere in your log you have 3 of these events occurring within 1 minute. Splunk needs to know how to give you ONE value for "Value", even though there are 3 values of each. You can tell Splunk to just give you an average from the 3 events using the stats function avg, like you have done:

... | timechart span=1m avg(connections) by node

Or, if you only want the values from the first of the events within the time period, use first instead of avg. Want the sum? Use sum. And so on. More information on statistical functions is available here: http://www.splunk.com/base/Documentation/latest/SearchReference/Stats

There's also a second way to do this, which is to produce a table containing timestamps and values yourself and then feed them into the chart.

... | table _time connections

RicoSuave
Builder
index=firewall | sourcetype=cisco | multikv fields connections | bucket _time span=1h as time | chart sum(connections) over time by node

you'll probably have to fool around with the span time, but that should do it.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...