Splunk Search

chart percentage over a timeframe

charles981
Engager

I have a webserver log with one entry per request. Every entry contains the used cipher. I want to generate a chart over the last days how many requests used cipher X as percentage of all requests for every hour in the timeframe.
It's no problem to select the right entries, but I'm not able to generate the chart. 😞 Every help is appreciated.

Tags (2)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Try something like this:

sourcetype=your_data | bin span=1h _time | stats count by _time cipher
| eventstats sum(count) as Total by _time | eval perc = count / Total * 100
| xyseries _time cipher perc

That's assuming the cipher name is extracted in field cipher.

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Try something like this:

sourcetype=your_data | bin span=1h _time | stats count by _time cipher
| eventstats sum(count) as Total by _time | eval perc = count / Total * 100
| xyseries _time cipher perc

That's assuming the cipher name is extracted in field cipher.

View solution in original post

0 Karma

charles981
Engager

Thanks a lot. Thats what I need!

0 Karma