Splunk Search

What is the least resource-intensive way to plot a line graph for event count for each sourcetype within a specified index?

kalik
Explorer

So I want to create a dashboard with each panel monitoring one index. Within a panel, it would be a timechart with count by time and each sourcetype would be represented by a separate line.

Here's a mockup of what I wanted to achieve:
alt text

I know it's pretty. Now the catch is - normal searches are gonna be very resource intensive and I'd rather have something lightweight if possible.

Any suggestions would be appreciated - I tried tstats but wasn't able to make it work in that manner.

Cheers!

1 Solution

somesoni2
Revered Legend

If you're just looking to plot event count by index and sourcetype, tstats would be the fastest way. Try like this

| tstats count WHERE index=YourIndex by _time sourcetype span=1d | timechart span=1d max(count) as count by sourcetype limit=0

View solution in original post

somesoni2
Revered Legend

If you're just looking to plot event count by index and sourcetype, tstats would be the fastest way. Try like this

| tstats count WHERE index=YourIndex by _time sourcetype span=1d | timechart span=1d max(count) as count by sourcetype limit=0

kalik
Explorer

Thanks @somesoni2, that's exacly what I was looking for!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...