Splunk Search

timechart with delta command using by clause

abhayneilam
Contributor

Hi,

I have a query like :

index=XXX sourcetype=YYY |search AGE = "*" NAME="CIA" OR NAME="FIA" |timechart span=1h sum(FIELD) as TOTAL1 | delta TOTAL1 as HERO | table _time HERO

I want my output as an area graph as a stacked graph but it should show CIA and FIA with the _time . I want to show _time in x-axis and in y it will be stacked graph for LIA and CIA. When I am modifying my query it is giving the straight line, it is not showing the ups and downs of the graph .

So please help me to use timechart command with by clause with multiple fileds using delta

Tags (3)
0 Karma
1 Solution

somesoni2
Revered Legend

Try this

If value for Name is ststic as CIA and FIA

index=XXX sourcetype=YYY |search AGE = "*" NAME="CIA" OR NAME="FIA" |timechart span=1h sum(FIELD) by NAME| delta CIA  as HEROCIA | delta  FIA as HEREFIA | table _time HEROCIA HEROFIA

View solution in original post

somesoni2
Revered Legend

Try this

If value for Name is ststic as CIA and FIA

index=XXX sourcetype=YYY |search AGE = "*" NAME="CIA" OR NAME="FIA" |timechart span=1h sum(FIELD) by NAME| delta CIA  as HEROCIA | delta  FIA as HEREFIA | table _time HEROCIA HEROFIA

somesoni2
Revered Legend

Try this for dynamic value of Name.

index=XXX sourcetype=YYY  AGE = "*" NAME="CIA" OR NAME="FIA" |bucket span=1h _time | stats sum(FIELD) as sum by _time,NAME|sort 0 _time| steamstats current=f window=1 first (sum) as prev by Name eval delta=sum - prev | xyseries _time Name delta
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Additionally, drop off the |search:

index=XXX sourcetype=YYY AGE = "*" (NAME="CIA" OR NAME="FIA") | timechart ...
0 Karma

abhayneilam
Contributor

How to make a query if the Name is not static as CIA and FIA ..

index=XXX sourcetype=YYY |search AGE = "" NAME="" |timechart span=1h sum(FIELD) by NAME| delta.......

please help in this regards, If the value is known then it is ok with the above example, but if the value is not known then how to deal with this kind of situation ? please help !!

0 Karma

abhayneilam
Contributor

Awesome, you are just awesome !! really very very much appreciated !!

Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...