Splunk Search

What is an alternative to timechart when needing aggregation on 2 by clauses?

dmoberg
Path Finder

I am struggling to figure out how to get the Visualization that I want, if even possible....

Timechart works great for this purpose but only when having 1 By clause (aggregated on one value), so if I have understood it properly, I should use the Stats command which supports multiple aggregations.

The end goal is to have one graph showing the following:

Y-axle: Count of the events

X-axle: Time

Graph lines: One Graph line shows the Count for a unique combination of responseCode and Location

OR possibly using Trellis (probably better) split By Location, so that each Location is a separate graph with one graph line showing the count for the responseCode.

The Search as it is now:

 

<<SEARCH>> | bin _time as time span=15m | stats count by _time,body.records.properties.responseCode,body.records.location

 

If using Trellis split by Location, this results in two graphs, one per Location where each has one graph line for Count (no matter the response code) and one more graph line for the response code itself (i.e. response code 200 becomes a line on 200 of the Y-axle). But I want 1 single graph line showing the count per unique responseCode (the legend should display the responseCode (i.e. 200).

Any ideas?

Labels (2)
Tags (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

SEARCH
| eval status_location = 'body.records.properties.responseCode'."_".'body.records.location'
| timechart span=15m count by status_location

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

SEARCH
| eval status_location = 'body.records.properties.responseCode'."_".'body.records.location'
| timechart span=15m count by status_location

efavreau
Motivator

@dmoberg 

Your description gives you a possible answer. You're looking for a combination of location and statuscode  by time. So that's what you provide to the timechart command:

| eval newfield = 'body.records.properties.responseCode' + "_" + 'body.records.location' ``` double check these single and double quotes due to editor here```
| timechart span=15 count BY newfield


What you end up with is a timechart showing something like this along your timechart:
200_Omaha
404_Anahiem

###

If this reply helps you, an upvote would be appreciated.
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...