Splunk Search

timechart per minute by multiple fields

sahil237888
Path Finder

Hi,

I have two fields with different values and I want count on both basis. These are events and hosts occured in log files.

Example -

I have fields like host and event.
Host values are like A , B, C,D.
Events are like reboot , running, shutdown.

And the results should show like -

_time A:reboot A:shutdown B:reboot C:running
00:01 1 2 1 4
00:02 2 4 3 1
00:03 0 1 4 5
00:04 1 2 0 1

0 Karma

to4kawa
Ultra Champion

sample:

| makeresults 
| eval host="a;b", events="reboot;running;shutdown" 
| makemv delim=";" host 
| makemv delim=";" events 
| stats values(_time) as _time by host events
| stats sum(eval(events="reboot")) as reboot sum(eval(events="running")) as running sum(eval(events="shutdown")) as shutdown by _time host
| xyseries _time host reboot running shutdown sep="_"
| foreach *_* [ rename <<FIELD>> as <<MATCHSEG2>>_<<MATCHSEG1>>]

recommend:

your_search
| bin _time span=1min
| stats count(eval(events="reboot")) as reboot count(eval(events="running")) as running count(eval(events="shutdown")) as shutdown by _time host
| xyseries _time host reboot running shutdown sep="_"
| foreach *_* [ rename <<FIELD>> as <<MATCHSEG2>>:<<MATCHSEG1>>]

Hi, @sahil237888
@MuS 's way is simple and good.
However, there is a problem.
If there is no status in the search period, the status will not be displayed.
If you need to output 0 as a result of three statuses, use my query.

0 Karma

MuS
Legend

Hi sahil237888,

you need to create a new field that represent host and the events and use this in the timechart command, take a look at this run everywhere SPL:

| makeresults 
| eval host="a;b", events="reboot;running;shutdown" 
| makemv delim=";" host 
| makemv delim=";" events 
| mvexpand host 
| mvexpand events 
| eval joiner=host .":". events 
| timechart span=1min count by joiner

Hope this helps ...

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...