Splunk Search

Unidimensional histogram (chart without "by" clause)

Contributor

I have difficulties to create a simple, unidimentional histogram. Suppose you have a log similar to this:

host=host1 sent=1 received=2
host=host2 sent=3 received=3
host=host1 sent=18 received=1

I'd like to create a simple histogram displaying the total amount of "sent" and "received", no matter what host.
The following search command doesn't give expected results because I end up with a single column with the value of 6 ("sum(received)") :

host=host* | chart sum(sent), sum(received)

What's wrong with my search?

Edit
Added pictures to clarify my question

Table view (correct):
alt text

Chart view (not correct ? or at least not what I would expect):
alt text

Tags (2)
1 Solution

SplunkTrust
SplunkTrust

AH! OK. In a previous answer, by "columns" you meant columns in a chart and I thought you meant columns as in a table. So we were both right.

Indeed, the chart here is misinterpreting what you want. In a chart each row is a data point, the first value in that row is the main x-axis value, and any subsequent values are taken as the one or more series to be charted.

The simplest way to fix this is to tack on a transpose command to give chart data it can interpret correctly:

 | chart sum(sent), sum(received) | transpose | rename column as type "row 1" as bytes

View solution in original post

SplunkTrust
SplunkTrust

AH! OK. In a previous answer, by "columns" you meant columns in a chart and I thought you meant columns as in a table. So we were both right.

Indeed, the chart here is misinterpreting what you want. In a chart each row is a data point, the first value in that row is the main x-axis value, and any subsequent values are taken as the one or more series to be charted.

The simplest way to fix this is to tack on a transpose command to give chart data it can interpret correctly:

 | chart sum(sent), sum(received) | transpose | rename column as type "row 1" as bytes

View solution in original post

Contributor

Thanks both for the explanation and the solution

0 Karma

Communicator

Here's a search, loosely based on documentation:

host=host* | chart sum(sent) AS sumsent, sum(received) AS sumreceived by _time | eval s1="Sent Received" | makemv s1 | mvexpand s1 | eval yval=case(s1=="Sent",sumsent,s1=="Received",sumreceived) | chart sum(yval) AS Sum by s1

Documentation link:

http://docs.splunk.com/Documentation/Splunk/5.0.4/Search/Chartmultipledataseries

Contributor

Works perfect. I would have thought there was a simpler way though.

0 Karma