Splunk Search

Timechart a dataset of weekly averages

Contributor

I have a dataset with some data points from a report I made; week end date(MM/DD/YYYY), host, user action, and average response time are the data-points. We have a large dataset so the run time is pretty long and we wanted to get rid of some noise and get a smoother line; really only looking for long term trends also. The idea was to average it out weekly into a data-set then graph the dataset. I am having some trouble getting the timechart to work with only using dataset data. Has anyone run into something like this? Run time is important as it will be housed in a dynamic dashboard with some selections.

In short can I timechart from only the dataset with weekly averages? Is there a better way to do this?

  | lookup systemOverview.csv hostName as hostName OUTPUT _time as OVTime, component as component, WeekAvg as WeekAvg, Name AS Name
  | timechart values(WeekAvg) by hostName 
0 Karma
1 Solution

Contributor

I was able to get the output I needed. Over thinking this but the following worked.

| inputlookup "systemVitals.csv"

I could then use the data I needed.

View solution in original post

0 Karma

Esteemed Legend

Like this:

|inputlookup systemOverview.csv
| sort 0 - _time
| timechart avg(WeekAvg) BY hostName 
0 Karma

Contributor

I was able to get the output I needed. Over thinking this but the following worked.

| inputlookup "systemVitals.csv"

I could then use the data I needed.

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

hello aohls, can you post your SPL? are you specifying 'span=1w' in your timechart?

0 Karma

Contributor

@jschogel I have added my search I am attempting, not the original search into the dataset. I did not specify the span in my timechart I was trying. I will give that a shot.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!