Splunk Search

Timechart/chart for getting the count of events with specified field value

macadminrohit
Contributor

Hi ,

I want a graph which actually gives me a ratio of count of events by host grouped together in a 15 minute interval for last 24 hours.

I have written a query like this index=servers sourcetype=xs_json Name=web url=www.google.com/something | rename bdy.msg as msg | chart span=15m count(eval(msg="HTTP Request Exceeded SLA")) as EXCEEDED count(eval(msg="HttpRequest")) as REQUEST by host | eval Ratio=EXCEEDED/REQUEST | fields - EXCEEDED - REQUEST

This gives me a graph, but i want the bars(for each host) to be grouped together for every 15 minutes interval. Any thoughts??

Tags (1)
0 Karma
1 Solution

adonio
Ultra Champion

the timechart needs the _time field, you are stripping it with your stats try to add it after the by clause
as a side note, no need to rename here and in general, try to do so (and other cosmetics) at the end of the query for better performance. lastly, the function is values not value
try this:

index=servers sourcetype=xs_json Name=web url=www.google.com/something 
| stats  count(eval(dby.msg="HTTP Request Exceeded SLA")) as EXCEEDED count(eval(bdy.msg="HttpRequest")) as REQUEST by host _time
 | eval Ratio=EXCEEDED/REQUEST 
 | timechart span=15m values(Ratio) by host 

hope it helps

View solution in original post

0 Karma

adonio
Ultra Champion

the timechart needs the _time field, you are stripping it with your stats try to add it after the by clause
as a side note, no need to rename here and in general, try to do so (and other cosmetics) at the end of the query for better performance. lastly, the function is values not value
try this:

index=servers sourcetype=xs_json Name=web url=www.google.com/something 
| stats  count(eval(dby.msg="HTTP Request Exceeded SLA")) as EXCEEDED count(eval(bdy.msg="HttpRequest")) as REQUEST by host _time
 | eval Ratio=EXCEEDED/REQUEST 
 | timechart span=15m values(Ratio) by host 

hope it helps

0 Karma

ssadanala1
Contributor

Please use trellis visualization to accomplish the requirement

0 Karma

macadminrohit
Contributor

I want time to be on X-axis and ratio on y-axis. with the above query I am getting host on x-axis and Ratio on y.

Also when I use the below query it doesn't give any stats :

index=servers sourcetype=xs_json Name=web url=www.google.com/something | rename bdy.msg as msg | stats  count(eval(msg="HTTP Request Exceeded SLA")) as EXCEEDED count(eval(msg="HttpRequest")) as REQUEST by host | eval Ratio=EXCEEDED/REQUEST | fields - EXCEEDED - REQUEST | timechart value(Ratio) by host 
0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...