Splunk Search

Timechart/chart for getting the count of events with specified field value

macadminrohit
Contributor

Hi ,

I want a graph which actually gives me a ratio of count of events by host grouped together in a 15 minute interval for last 24 hours.

I have written a query like this index=servers sourcetype=xs_json Name=web url=www.google.com/something | rename bdy.msg as msg | chart span=15m count(eval(msg="HTTP Request Exceeded SLA")) as EXCEEDED count(eval(msg="HttpRequest")) as REQUEST by host | eval Ratio=EXCEEDED/REQUEST | fields - EXCEEDED - REQUEST

This gives me a graph, but i want the bars(for each host) to be grouped together for every 15 minutes interval. Any thoughts??

Tags (1)
0 Karma
1 Solution

adonio
Ultra Champion

the timechart needs the _time field, you are stripping it with your stats try to add it after the by clause
as a side note, no need to rename here and in general, try to do so (and other cosmetics) at the end of the query for better performance. lastly, the function is values not value
try this:

index=servers sourcetype=xs_json Name=web url=www.google.com/something 
| stats  count(eval(dby.msg="HTTP Request Exceeded SLA")) as EXCEEDED count(eval(bdy.msg="HttpRequest")) as REQUEST by host _time
 | eval Ratio=EXCEEDED/REQUEST 
 | timechart span=15m values(Ratio) by host 

hope it helps

View solution in original post

0 Karma

adonio
Ultra Champion

the timechart needs the _time field, you are stripping it with your stats try to add it after the by clause
as a side note, no need to rename here and in general, try to do so (and other cosmetics) at the end of the query for better performance. lastly, the function is values not value
try this:

index=servers sourcetype=xs_json Name=web url=www.google.com/something 
| stats  count(eval(dby.msg="HTTP Request Exceeded SLA")) as EXCEEDED count(eval(bdy.msg="HttpRequest")) as REQUEST by host _time
 | eval Ratio=EXCEEDED/REQUEST 
 | timechart span=15m values(Ratio) by host 

hope it helps

0 Karma

ssadanala1
Contributor

Please use trellis visualization to accomplish the requirement

0 Karma

macadminrohit
Contributor

I want time to be on X-axis and ratio on y-axis. with the above query I am getting host on x-axis and Ratio on y.

Also when I use the below query it doesn't give any stats :

index=servers sourcetype=xs_json Name=web url=www.google.com/something | rename bdy.msg as msg | stats  count(eval(msg="HTTP Request Exceeded SLA")) as EXCEEDED count(eval(msg="HttpRequest")) as REQUEST by host | eval Ratio=EXCEEDED/REQUEST | fields - EXCEEDED - REQUEST | timechart value(Ratio) by host 
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...