Splunk Search

timechart / chart

tmarlette
Motivator

I know I've done this before, and I've completely forgotten, and I didn't see anything in the documentation on how to chart a value over time of a field. Im' having a complete brain fart.

I am attempeint to chart the value of a field over time (in this case perfmon values)

this is my search:

sourcetype=Perfmon* object=Processor counter="% Processor Time" | timechart Value by host

Can someone please refresh my memory on how to do this?

Tags (2)
0 Karma
1 Solution

linu1988
Champion

Hello,
you are doing it right

sourcetype=Perfmon* object=Processor counter="% Processor Time" instance=_Total| timechart avg(Value) span=1m by host

Thanks

View solution in original post

linu1988
Champion

Hello,
you are doing it right

sourcetype=Perfmon* object=Processor counter="% Processor Time" instance=_Total| timechart avg(Value) span=1m by host

Thanks

linu1988
Champion

The interval you are collecting data that you can mention as span then it will give you the original value.

|timechart avg(Value) span=1m by host useother=f

OR

|timechart per_minute(Value) by host useother=f

OR

|timechart Values(Value) span=Monitored_Interval by host useother=f

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Note, by default Windows Performance Monitor events suppress zero values, giving you inaccurate averages in many cases.
If that's an issue you can force zeroes to be reported through the input.conf stanzas by setting showZeroValue=1.

0 Karma

tmarlette
Motivator

What if I just wanted to chart the values, and not the averages?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

How about "|timechart first(Value) as Value by host"? You can use min or max as well, as long as you keep the span of timechart same as the frequency of events.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...