Splunk Search

how to modify my query to display a detail view with hosts?

pavanae
Builder

I have a search as follows

field="abc"| eval b=len(_raw) | timechart span=1h sum(b) as b | eval mb=round(b/1024/1024,2) | eval gb=round(b/1024/1024/1024,2) | eventstats avg(gb) as Avg

Which displays the result as follows

alt text

Now I want to modify my search to see a time chart which displays the average gb for each host per hour. Is there any way to modify my search to display like that?

0 Karma
1 Solution

woodcock
Esteemed Legend

The trick is that you need to do the "bucketing" that timechart does, twice: once to calculate each hosts's hourly sum and then again to avg all hosts' sums. This is a exactly why the bucket (AKA bin) command exists. Do it like this:

field="abc"| eval b=len(_raw)
| bucket _time span=1h | stats sum(b) AS b by _time host
| timechart span=1h avg(b) as b | eval mb=round(b/1024/1024,2) | eval gb=round(b/1024/1024/1024,2)

View solution in original post

0 Karma

woodcock
Esteemed Legend

The trick is that you need to do the "bucketing" that timechart does, twice: once to calculate each hosts's hourly sum and then again to avg all hosts' sums. This is a exactly why the bucket (AKA bin) command exists. Do it like this:

field="abc"| eval b=len(_raw)
| bucket _time span=1h | stats sum(b) AS b by _time host
| timechart span=1h avg(b) as b | eval mb=round(b/1024/1024,2) | eval gb=round(b/1024/1024/1024,2)
0 Karma

javiergn
Super Champion

Based on your indications above:

I want to modify my search to see a time chart which displays the average gb for each host per hour

I guess this is what you are looking for:

field="abc"
| eval b=len(_raw) 
| timechart span=1h avg(b) as b by host
| foreach * [eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024,10)]

NOTE: I have rounded that to include up to 10 decimals mainly because I don't know how much data is going through your hosts but feel free to revert that back to 2 o whichever value fits your needs.

inventsekar
SplunkTrust
SplunkTrust
field="abc"| eval b=len(_raw) | timechart span=1h sum(b) as b | eval mb=round(b/1024/1024,2) | eval gb=round(b/1024/1024/1024,2) | eventstats avg(gb) as Avg by host
thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

pavanae
Builder

Hi sorry there isn't any change in my result.

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...