Splunk Search

timechart per minute by multiple fields

sahil237888
Path Finder

Hi,

I have two fields with different values and I want count on both basis. These are events and hosts occured in log files.

Example -

I have fields like host and event.
Host values are like A , B, C,D.
Events are like reboot , running, shutdown.

And the results should show like -

_time A:reboot A:shutdown B:reboot C:running
00:01 1 2 1 4
00:02 2 4 3 1
00:03 0 1 4 5
00:04 1 2 0 1

0 Karma

to4kawa
Ultra Champion

sample:

| makeresults 
| eval host="a;b", events="reboot;running;shutdown" 
| makemv delim=";" host 
| makemv delim=";" events 
| stats values(_time) as _time by host events
| stats sum(eval(events="reboot")) as reboot sum(eval(events="running")) as running sum(eval(events="shutdown")) as shutdown by _time host
| xyseries _time host reboot running shutdown sep="_"
| foreach *_* [ rename <<FIELD>> as <<MATCHSEG2>>_<<MATCHSEG1>>]

recommend:

your_search
| bin _time span=1min
| stats count(eval(events="reboot")) as reboot count(eval(events="running")) as running count(eval(events="shutdown")) as shutdown by _time host
| xyseries _time host reboot running shutdown sep="_"
| foreach *_* [ rename <<FIELD>> as <<MATCHSEG2>>:<<MATCHSEG1>>]

Hi, @sahil237888
@MuS 's way is simple and good.
However, there is a problem.
If there is no status in the search period, the status will not be displayed.
If you need to output 0 as a result of three statuses, use my query.

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi sahil237888,

you need to create a new field that represent host and the events and use this in the timechart command, take a look at this run everywhere SPL:

| makeresults 
| eval host="a;b", events="reboot;running;shutdown" 
| makemv delim=";" host 
| makemv delim=";" events 
| mvexpand host 
| mvexpand events 
| eval joiner=host .":". events 
| timechart span=1min count by joiner

Hope this helps ...

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...