Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: timechart dynamic fields
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Took the below example from documentation....
Chart a single day's views and purchases at the Buttercup Games online store.
sourcetype=access_* | timechart per_hour(eval(method="GET")) AS Views, per_hour(eval(action="purchase")) AS Purchases
Want to do something similar but need to timechart count for all the events to host=wap4* and to host=wap5*
Don't want a side by side chart...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this
sourcetype=access_* | timechart per_hour(eval(LIKE(host,"wap4%"))) AS wap4Count, per_hour(eval(LIKE(host,"wap5%"))) AS wap5Count
Note that * is replaced by %
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Great.. I have converted my comment as answer. Please accept the answer if there are no followup question.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Cool... it works!!!!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this
sourcetype=access_* | timechart per_hour(eval(LIKE(host,"wap4%"))) AS wap4Count, per_hour(eval(LIKE(host,"wap5%"))) AS wap5Count
Note that * is replaced by %
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I hope you are able to see the * after wap4 and wap5
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
close... but what i want to do is
sourcetype=access_* | timechart per_hour(eval(host="wap4*")) AS wap4Count, per_hour(eval(host="wap5*")) AS wap5Count
This doesn't work.
the below one was also close but then it also doesn't work with wild cards..
source=usgs | eval Description=case(depth<=70, "Shallow", depth>70 AND depth<=300, "Mid", depth>300, "Deep") | stats count min(mag) max(mag) by Description
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Are you looking for something like this:-
sourcetype=access_* | timechart per_hour(eval(host="wap4")) AS wap4Count, per_hour(eval(host="wap5")) AS wap5Count
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Any help on this one?
I am not looking to filter but timechart count by host where host can 2 types... one which starts with wap4 and another that starts with wap3...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am not looking to filter but timechart count by host where host can 2 types... one which starts with wap4* and another that starts with wap3*...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If all you want to do is filter so that you only get events from those two hosts, just add those as search filters in your base search:
sourcetype=access_* host=wap4* host=wap5* | timechart per_hour(eval(method="GET")) AS Views, per_hour(eval(action="purchase")) AS Purchases
...assuming the destination host is in the "host" field. If it's in another field, just use that instead.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
want to group wap4* as 1 type of host and wap3* as another type. Don't want individual time chart
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Just add by host in the timechart.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Agent Mode Engaged! Enchaining Agentic Operations with Splunk AI Assistant 2.0
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
