Splunk Search

TimeChart by 2 fields

Gulrez
Engager

I am trying to create a timechart by 2 fields
Here is what I tried:
source=abc CounterName="\Process(System)\% Processor Time"| timechart span=1h avg(CounterValue) by RoleInstance CounterName

Any idea how this could be achieved?

Tags (1)

shahab1khan
Engager

how about

source=abc CounterName="\Process(System)\% Processor Time" | stas count by RoleInstance,CounterName

view the visualization tab to get charts afterwards

0 Karma

shahab1khan
Engager

You can use the following and view the visualization tab

|stats count by field1,field2

asifpasha23
New Member

span is not working with chart. But I tried something below which works for me
chart perc90(s), count(s) by host

0 Karma

somesoni2
Revered Legend

Something like this

source=abc CounterName="\Process(System)\% Processor Time" | eval Role_Counter=RoleInstance + "#" + CounterName| timechart span=1h avg(CounterValue) by Role_Counter

MuS
Legend

timechart values(foo) by bar
Is the same like
chart values(foo) over_time by bar
But like linu said chart can have more then one by clause

0 Karma

rvany
Communicator

This is an older one - but for reference:

I don't think, that this is completely true. chart can have a and a . It's more flexible than timechart as the can be something other than _time. But you only have these to split-options (I believe, it was the same in 2014 with version 6.0.# or older).

If I'm wrong, just tell me so I can learn more and more...

0 Karma

linu1988
Champion

chart does support more fields. why to limit urself with timechart. They almost do the same.

somesoni2
Revered Legend

Time chart just work with one field in "by" clause. You can concatenate multiple field into one and use in timechart.

0 Karma

Gulrez
Engager

Can we scale this to more than 2 fields?

0 Karma

linu1988
Champion

or bucket _time span=1h|chart avg(CounterValue) by RoleInstance,CounterName

somesoni2
Revered Legend

You can concat both the fields into one field and do a timechart on that.

Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...