Splunk Search

What is the least resource-intensive way to plot a line graph for event count for each sourcetype within a specified index?

kalik
Explorer

So I want to create a dashboard with each panel monitoring one index. Within a panel, it would be a timechart with count by time and each sourcetype would be represented by a separate line.

Here's a mockup of what I wanted to achieve:
alt text

I know it's pretty. Now the catch is - normal searches are gonna be very resource intensive and I'd rather have something lightweight if possible.

Any suggestions would be appreciated - I tried tstats but wasn't able to make it work in that manner.

Cheers!

1 Solution

somesoni2
SplunkTrust
SplunkTrust

If you're just looking to plot event count by index and sourcetype, tstats would be the fastest way. Try like this

| tstats count WHERE index=YourIndex by _time sourcetype span=1d | timechart span=1d max(count) as count by sourcetype limit=0

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

If you're just looking to plot event count by index and sourcetype, tstats would be the fastest way. Try like this

| tstats count WHERE index=YourIndex by _time sourcetype span=1d | timechart span=1d max(count) as count by sourcetype limit=0

kalik
Explorer

Thanks @somesoni2, that's exacly what I was looking for!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...