Splunk Search

Timechart/chart for getting the count of events with specified field value

macadminrohit
Contributor

Hi ,

I want a graph which actually gives me a ratio of count of events by host grouped together in a 15 minute interval for last 24 hours.

I have written a query like this index=servers sourcetype=xs_json Name=web url=www.google.com/something | rename bdy.msg as msg | chart span=15m count(eval(msg="HTTP Request Exceeded SLA")) as EXCEEDED count(eval(msg="HttpRequest")) as REQUEST by host | eval Ratio=EXCEEDED/REQUEST | fields - EXCEEDED - REQUEST

This gives me a graph, but i want the bars(for each host) to be grouped together for every 15 minutes interval. Any thoughts??

Tags (1)
0 Karma
1 Solution

adonio
Ultra Champion

the timechart needs the _time field, you are stripping it with your stats try to add it after the by clause
as a side note, no need to rename here and in general, try to do so (and other cosmetics) at the end of the query for better performance. lastly, the function is values not value
try this:

index=servers sourcetype=xs_json Name=web url=www.google.com/something 
| stats  count(eval(dby.msg="HTTP Request Exceeded SLA")) as EXCEEDED count(eval(bdy.msg="HttpRequest")) as REQUEST by host _time
 | eval Ratio=EXCEEDED/REQUEST 
 | timechart span=15m values(Ratio) by host 

hope it helps

View solution in original post

0 Karma

adonio
Ultra Champion

the timechart needs the _time field, you are stripping it with your stats try to add it after the by clause
as a side note, no need to rename here and in general, try to do so (and other cosmetics) at the end of the query for better performance. lastly, the function is values not value
try this:

index=servers sourcetype=xs_json Name=web url=www.google.com/something 
| stats  count(eval(dby.msg="HTTP Request Exceeded SLA")) as EXCEEDED count(eval(bdy.msg="HttpRequest")) as REQUEST by host _time
 | eval Ratio=EXCEEDED/REQUEST 
 | timechart span=15m values(Ratio) by host 

hope it helps

0 Karma

ssadanala1
Contributor

Please use trellis visualization to accomplish the requirement

0 Karma

macadminrohit
Contributor

I want time to be on X-axis and ratio on y-axis. with the above query I am getting host on x-axis and Ratio on y.

Also when I use the below query it doesn't give any stats :

index=servers sourcetype=xs_json Name=web url=www.google.com/something | rename bdy.msg as msg | stats  count(eval(msg="HTTP Request Exceeded SLA")) as EXCEEDED count(eval(msg="HttpRequest")) as REQUEST by host | eval Ratio=EXCEEDED/REQUEST | fields - EXCEEDED - REQUEST | timechart value(Ratio) by host 
0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...