Splunk Search

Timechart 4 variable

sathish2k8
Explorer

index=nil sourcetype="niller" host=*| eval flag=if(timeout>5000,"Timeout","Total")| timechart span=1m count(flag) as number_of_timeouts by flag

Above search string obtains result from both host (host1,host2). If i want to display unified value from both dashboard host=* is working but i want to display from both host and it has to show both total and timeout also.

Please help how.

Thanks. (splunk 7.0)

Tags (1)
0 Karma

mayurr98
Super Champion

I do not think it is possible through timechart command
Well you need to try something like this

index=nil sourcetype="niller" host=* 
| bin _time span=1m 
| eval flag=if(timeout>5000,"Timeout","Total") 
| stats count(flag) as number_of_timeouts by flag host _time

let me know if this helps!

0 Karma

sathish2k8
Explorer

it is not working my scenario, i want to distinguish both the hosts. this search is working but i have to show 2 different host in same chart. please help

0 Karma
Get Updates on the Splunk Community!

Splunk ITSI & Correlated Network Visibility

  Now On Demand   Take Your Network Visibility to the Next Level In today’s complex IT environments, ...

Community Content Calendar, August edition

In the dynamic world of cybersecurity, staying ahead means constantly solving new puzzles and optimizing your ...

Pro Tips for First-Time .conf Attendees: Advice from SplunkTrust

Heading to your first .Conf? You’re in for an unforgettable ride — learning, networking, swag collecting, ...