Splunk Search

What is an alternative to timechart when needing aggregation on 2 by clauses?

dmoberg
Path Finder

I am struggling to figure out how to get the Visualization that I want, if even possible....

Timechart works great for this purpose but only when having 1 By clause (aggregated on one value), so if I have understood it properly, I should use the Stats command which supports multiple aggregations.

The end goal is to have one graph showing the following:

Y-axle: Count of the events

X-axle: Time

Graph lines: One Graph line shows the Count for a unique combination of responseCode and Location

OR possibly using Trellis (probably better) split By Location, so that each Location is a separate graph with one graph line showing the count for the responseCode.

The Search as it is now:

 

<<SEARCH>> | bin _time as time span=15m | stats count by _time,body.records.properties.responseCode,body.records.location

 

If using Trellis split by Location, this results in two graphs, one per Location where each has one graph line for Count (no matter the response code) and one more graph line for the response code itself (i.e. response code 200 becomes a line on 200 of the Y-axle). But I want 1 single graph line showing the count per unique responseCode (the legend should display the responseCode (i.e. 200).

Any ideas?

Labels (2)
Tags (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

SEARCH
| eval status_location = 'body.records.properties.responseCode'."_".'body.records.location'
| timechart span=15m count by status_location

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

SEARCH
| eval status_location = 'body.records.properties.responseCode'."_".'body.records.location'
| timechart span=15m count by status_location

efavreau
Motivator

@dmoberg 

Your description gives you a possible answer. You're looking for a combination of location and statuscode  by time. So that's what you provide to the timechart command:

| eval newfield = 'body.records.properties.responseCode' + "_" + 'body.records.location' ``` double check these single and double quotes due to editor here```
| timechart span=15 count BY newfield


What you end up with is a timechart showing something like this along your timechart:
200_Omaha
404_Anahiem

###

If this reply helps you, an upvote would be appreciated.
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...