I've searchs Splunk Answers and I have gotten two search strings, where if combined, would give me the results I would like.
The field values that I can get out of my search are like the following:
Where capital letters are referencing an IP address.
* | eval upordown=if(state_to="Up ",+1,-1)| streamstats sum(upordown) as concurrency by neighbor | timechart max(concurrency) by neighbor
This one provides a graph for multiple interfaces with a color-coded key to the right that I can hover over, but shows unnecessary values. I honestly just want a line for each interface like a sparkline, but... more appealing.
src_ip="IPADDRESS" | transaction Uptime startswith=(state_to=Up) endswith=(state_to=Down) | concurrency duration=duration | timechart avg(concurrency) as UpDown
this is perfect for a specific interface, but like the top one I want it to show multiple interfaces. I've been staring at this for 2x 12 hour shifts now, but I am not familiar with splunk's language and commands.
I was thinking of having a search just get a table of all interfaces at searchtime and (somehow) use the row number as the value for the graph line of each interface (that way each one is a separate line) and somehow cram all that in with the other two strings so if the interface is "Up", be the value of the row number and if it is down, multiply the filldown value by 0. I haven't gotten a search with filldown to work yet either hence why I didn't include it in the code above.
Can anyone help? I have a good feeling this is possible, I think I have just been staring at this too long.
... View more