Splunk Search
Highlighted

timechart where field name and value are both in event data

Motivator

I have a database query that runs every 5 minutes. It brings back queue names and the counts of those queues. I would like to make a timechart that would show all of the queues and their counts over time.

My data comes out like this:

2017-02-09 10:51:30 QUEUE="LIFEUpdatePolicySecurity", LIFEQUEUECOUNT="5"
2017-02-09 10:51:30 QUEUE="LIFE
UpdateAnnuitySecurity", LIFEQUEUECOUNT="38"
2017-02-09 10:51:30 QUEUE="Policy File Document", LIFEQUEUECOUNT="3"
2017-02-09 10:51:30 QUEUE="Annuity File Document", LIFEQUEUECOUNT="25"

I would like to eventually end up with a line graph that would have a line or each queue name and show the count for each over time but I'm struggling to get the stats to line up to get it there.

0 Karma
Highlighted

Re: timechart where field name and value are both in event data

SplunkTrust
SplunkTrust

Have you tried ... | timechart max(LIFE_QUEUE_COUNT) by QUEUE ?

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

Highlighted

Re: timechart where field name and value are both in event data

SplunkTrust
SplunkTrust

If you've 10 or more distinct QUEUEs, then add limit=0 ( or any feasible number) so that there is a line for every queue.

0 Karma
Highlighted

Re: timechart where field name and value are both in event data

Motivator

See I knew it was going to be something simple. I just had to flip my thinking. Thank you so much that's exactly what I wanted!!

0 Karma