Splunk Search

What is the least resource-intensive way to plot a line graph for event count for each sourcetype within a specified index?

kalik
Explorer

So I want to create a dashboard with each panel monitoring one index. Within a panel, it would be a timechart with count by time and each sourcetype would be represented by a separate line.

Here's a mockup of what I wanted to achieve:
alt text

I know it's pretty. Now the catch is - normal searches are gonna be very resource intensive and I'd rather have something lightweight if possible.

Any suggestions would be appreciated - I tried tstats but wasn't able to make it work in that manner.

Cheers!

1 Solution

somesoni2
Revered Legend

If you're just looking to plot event count by index and sourcetype, tstats would be the fastest way. Try like this

| tstats count WHERE index=YourIndex by _time sourcetype span=1d | timechart span=1d max(count) as count by sourcetype limit=0

View solution in original post

somesoni2
Revered Legend

If you're just looking to plot event count by index and sourcetype, tstats would be the fastest way. Try like this

| tstats count WHERE index=YourIndex by _time sourcetype span=1d | timechart span=1d max(count) as count by sourcetype limit=0

kalik
Explorer

Thanks @somesoni2, that's exacly what I was looking for!

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...