Splunk Search

timechart with delta command using by clause

Contributor

Hi,

I have a query like :

index=XXX sourcetype=YYY |search AGE = "*" NAME="CIA" OR NAME="FIA" |timechart span=1h sum(FIELD) as TOTAL1 | delta TOTAL1 as HERO | table _time HERO

I want my output as an area graph as a stacked graph but it should show CIA and FIA with the _time . I want to show _time in x-axis and in y it will be stacked graph for LIA and CIA. When I am modifying my query it is giving the straight line, it is not showing the ups and downs of the graph .

So please help me to use timechart command with by clause with multiple fileds using delta

Tags (3)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Try this

If value for Name is ststic as CIA and FIA

index=XXX sourcetype=YYY |search AGE = "*" NAME="CIA" OR NAME="FIA" |timechart span=1h sum(FIELD) by NAME| delta CIA  as HEROCIA | delta  FIA as HEREFIA | table _time HEROCIA HEROFIA

View solution in original post

SplunkTrust
SplunkTrust

Try this

If value for Name is ststic as CIA and FIA

index=XXX sourcetype=YYY |search AGE = "*" NAME="CIA" OR NAME="FIA" |timechart span=1h sum(FIELD) by NAME| delta CIA  as HEROCIA | delta  FIA as HEREFIA | table _time HEROCIA HEROFIA

View solution in original post

SplunkTrust
SplunkTrust

Try this for dynamic value of Name.

index=XXX sourcetype=YYY  AGE = "*" NAME="CIA" OR NAME="FIA" |bucket span=1h _time | stats sum(FIELD) as sum by _time,NAME|sort 0 _time| steamstats current=f window=1 first (sum) as prev by Name eval delta=sum - prev | xyseries _time Name delta
0 Karma

SplunkTrust
SplunkTrust

Additionally, drop off the |search:

index=XXX sourcetype=YYY AGE = "*" (NAME="CIA" OR NAME="FIA") | timechart ...
0 Karma

Contributor

How to make a query if the Name is not static as CIA and FIA ..

index=XXX sourcetype=YYY |search AGE = "" NAME="" |timechart span=1h sum(FIELD) by NAME| delta.......

please help in this regards, If the value is known then it is ok with the above example, but if the value is not known then how to deal with this kind of situation ? please help !!

0 Karma

Contributor

Awesome, you are just awesome !! really very very much appreciated !!