Splunk Search

Unidimensional histogram (chart without "by" clause)

yoho
Contributor

I have difficulties to create a simple, unidimentional histogram. Suppose you have a log similar to this:

host=host1 sent=1 received=2
host=host2 sent=3 received=3
host=host1 sent=18 received=1

I'd like to create a simple histogram displaying the total amount of "sent" and "received", no matter what host.
The following search command doesn't give expected results because I end up with a single column with the value of 6 ("sum(received)") :

host=host* | chart sum(sent), sum(received)

What's wrong with my search?

Edit
Added pictures to clarify my question

Table view (correct):
alt text

Chart view (not correct ? or at least not what I would expect):
alt text

Tags (2)
1 Solution

sideview
SplunkTrust
SplunkTrust

AH! OK. In a previous answer, by "columns" you meant columns in a chart and I thought you meant columns as in a table. So we were both right.

Indeed, the chart here is misinterpreting what you want. In a chart each row is a data point, the first value in that row is the main x-axis value, and any subsequent values are taken as the one or more series to be charted.

The simplest way to fix this is to tack on a transpose command to give chart data it can interpret correctly:

 | chart sum(sent), sum(received) | transpose | rename column as type "row 1" as bytes

View solution in original post

sideview
SplunkTrust
SplunkTrust

AH! OK. In a previous answer, by "columns" you meant columns in a chart and I thought you meant columns as in a table. So we were both right.

Indeed, the chart here is misinterpreting what you want. In a chart each row is a data point, the first value in that row is the main x-axis value, and any subsequent values are taken as the one or more series to be charted.

The simplest way to fix this is to tack on a transpose command to give chart data it can interpret correctly:

 | chart sum(sent), sum(received) | transpose | rename column as type "row 1" as bytes

yoho
Contributor

Thanks both for the explanation and the solution

0 Karma

srioux
Communicator

Here's a search, loosely based on documentation:

host=host* | chart sum(sent) AS sumsent, sum(received) AS sumreceived by _time | eval s1="Sent Received" | makemv s1 | mvexpand s1 | eval yval=case(s1=="Sent",sumsent,s1=="Received",sumreceived) | chart sum(yval) AS Sum by s1

Documentation link:

http://docs.splunk.com/Documentation/Splunk/5.0.4/Search/Chartmultipledataseries

yoho
Contributor

Works perfect. I would have thought there was a simpler way though.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...