Splunk Search

timechart with delta command using by clause

abhayneilam
Contributor

Hi,

I have a query like :

index=XXX sourcetype=YYY |search AGE = "*" NAME="CIA" OR NAME="FIA" |timechart span=1h sum(FIELD) as TOTAL1 | delta TOTAL1 as HERO | table _time HERO

I want my output as an area graph as a stacked graph but it should show CIA and FIA with the _time . I want to show _time in x-axis and in y it will be stacked graph for LIA and CIA. When I am modifying my query it is giving the straight line, it is not showing the ups and downs of the graph .

So please help me to use timechart command with by clause with multiple fileds using delta

Tags (3)
0 Karma
1 Solution

somesoni2
Revered Legend

Try this

If value for Name is ststic as CIA and FIA

index=XXX sourcetype=YYY |search AGE = "*" NAME="CIA" OR NAME="FIA" |timechart span=1h sum(FIELD) by NAME| delta CIA  as HEROCIA | delta  FIA as HEREFIA | table _time HEROCIA HEROFIA

View solution in original post

somesoni2
Revered Legend

Try this

If value for Name is ststic as CIA and FIA

index=XXX sourcetype=YYY |search AGE = "*" NAME="CIA" OR NAME="FIA" |timechart span=1h sum(FIELD) by NAME| delta CIA  as HEROCIA | delta  FIA as HEREFIA | table _time HEROCIA HEROFIA

somesoni2
Revered Legend

Try this for dynamic value of Name.

index=XXX sourcetype=YYY  AGE = "*" NAME="CIA" OR NAME="FIA" |bucket span=1h _time | stats sum(FIELD) as sum by _time,NAME|sort 0 _time| steamstats current=f window=1 first (sum) as prev by Name eval delta=sum - prev | xyseries _time Name delta
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Additionally, drop off the |search:

index=XXX sourcetype=YYY AGE = "*" (NAME="CIA" OR NAME="FIA") | timechart ...
0 Karma

abhayneilam
Contributor

How to make a query if the Name is not static as CIA and FIA ..

index=XXX sourcetype=YYY |search AGE = "" NAME="" |timechart span=1h sum(FIELD) by NAME| delta.......

please help in this regards, If the value is known then it is ok with the above example, but if the value is not known then how to deal with this kind of situation ? please help !!

0 Karma

abhayneilam
Contributor

Awesome, you are just awesome !! really very very much appreciated !!

Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...