Splunk Search

Unidimensional histogram (chart without "by" clause)

yoho
Contributor

I have difficulties to create a simple, unidimentional histogram. Suppose you have a log similar to this:

host=host1 sent=1 received=2
host=host2 sent=3 received=3
host=host1 sent=18 received=1

I'd like to create a simple histogram displaying the total amount of "sent" and "received", no matter what host.
The following search command doesn't give expected results because I end up with a single column with the value of 6 ("sum(received)") :

host=host* | chart sum(sent), sum(received)

What's wrong with my search?

Edit
Added pictures to clarify my question

Table view (correct):
alt text

Chart view (not correct ? or at least not what I would expect):
alt text

Tags (2)
1 Solution

sideview
SplunkTrust
SplunkTrust

AH! OK. In a previous answer, by "columns" you meant columns in a chart and I thought you meant columns as in a table. So we were both right.

Indeed, the chart here is misinterpreting what you want. In a chart each row is a data point, the first value in that row is the main x-axis value, and any subsequent values are taken as the one or more series to be charted.

The simplest way to fix this is to tack on a transpose command to give chart data it can interpret correctly:

 | chart sum(sent), sum(received) | transpose | rename column as type "row 1" as bytes

View solution in original post

sideview
SplunkTrust
SplunkTrust

AH! OK. In a previous answer, by "columns" you meant columns in a chart and I thought you meant columns as in a table. So we were both right.

Indeed, the chart here is misinterpreting what you want. In a chart each row is a data point, the first value in that row is the main x-axis value, and any subsequent values are taken as the one or more series to be charted.

The simplest way to fix this is to tack on a transpose command to give chart data it can interpret correctly:

 | chart sum(sent), sum(received) | transpose | rename column as type "row 1" as bytes

yoho
Contributor

Thanks both for the explanation and the solution

0 Karma

srioux
Communicator

Here's a search, loosely based on documentation:

host=host* | chart sum(sent) AS sumsent, sum(received) AS sumreceived by _time | eval s1="Sent Received" | makemv s1 | mvexpand s1 | eval yval=case(s1=="Sent",sumsent,s1=="Received",sumreceived) | chart sum(yval) AS Sum by s1

Documentation link:

http://docs.splunk.com/Documentation/Splunk/5.0.4/Search/Chartmultipledataseries

yoho
Contributor

Works perfect. I would have thought there was a simpler way though.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

 Are you ready to revolutionize your IT operations? As digital transformation accelerates, the demand for ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...