Excellent, thanks. I came across a "2-phase" similar strategy in a question about FIX logs. Its a really useful way of working with ugly log formats. I can pull out other values with rex in the search command. You also resolved some other issues on linebreaking I was having. ... View more

Worked a treat. Thanks. ... View more

Doh! Thanks. ... View more

No answers yet, but I did switch to JSChart (no difference) and run splunk in debug mode to have a look at the _internal indexes. There is a repeating pattern around the time that the drilldown is run: class=js_chart.js, XHR clear for takeoff for module JSChart_1_15_0 class=js_chart.js, XHR in-flight destroyed for module JSChart_1_15_0 for job 1332161165.8 and replaced with new one class=js_chart.js, Splunk.Module.JSChart .getResults() aborted class=js_chart.js, Aborting getResults request for Splunk.Module.JSChart Any ideas why the module would abort the search? ... View more

Here are the relevant parts of the dashboard. Search performance is reasonably and the drilldown triggers searches containing the correct intentions but the chart never appears. <module name="HiddenSearch"> <param name="search">index=main sourcetype=rpt-pur-2 filter="foo" | eval dVolGB=(DOWNSTREAM_VOLUME/1000000) | bucket span=1h _time | stats sum(dVolGB) as downGB by _time, date_wday, PackageName, ServiceType | fields + _time date_wday PackageName downGB ServiceType </param> <module name="HiddenPostProcess"> <param name="search">timechart sum(downGB) by ServiceType</param> <module name="SimpleResultsHeader" layoutPanel="panel_row2_col2"> <param name="entityName">results</param> <param name="headerFormat">Selected Packages: Download Activity per day</param> </module> <module name="HiddenChartFormatter" layoutPanel="panel_row2_col2"> <param name="chart">column</param> <param name="chart.stackMode">stacked</param> <param name="primaryAxisTitle.text"></param> <param name="secondaryAxisTitle.text">GBytes downloaded</param> <param name="legend.placement">none</param> <module name="FlashChart"> <param name="width">100%</param> <param name="height">320px</param> <param name="enableResize">False</param> </module> </module> <!-- end chart stuff --> </module> <!-- end hidden post process --> <module name="HiddenPostProcess"> <param name="search"> eval dtg=strftime(_time, "%H") | stats sum(downGB) as downGBytes by dtg, date_wday, PackageName | dedup 1 date_wday, PackageName sortby -downGBytes | chart values(dtg) over PackageName by date_wday | fields PackageName sunday monday tuesday wednesday thursday friday saturday </param> <module name="SimpleResultsHeader" layoutPanel="panel_row2_col1"> <param name="entityName">results</param> <param name="headerFormat">Select Packages: Peak hour per day.</param> </module> <module name="SimpleResultsTable" layoutPanel="panel_row2_col1"> <param name="displayRowNumbers">false</param> <param name="drilldown">all</param> <param name="count">0</param> <module name="HiddenSearch"> <param name="search">index=main sourcetype=rpt-pur-2 NOT "TIME_STAMP" | eval downMBytes=(DOWNSTREAM_VOLUME/1000) | chart sum(downMBytes) by date_hour, ServiceType </param> <module name="ConvertToIntention"> <param name="intention"> <param name="name">addterm</param> <param name="arg"> <param name="date_wday">$click.name2$</param> </param> <param name="flags"><list>indexed</list></param> </param> <module name="ConvertToIntention"> <param name="intention"> <param name="name">addterm</param> <param name="arg"> <param name="PackageName">$click.value$</param> </param> <param name="flags"><list>indexed</list></param> </param> <module name="SimpleResultsHeader" layoutPanel="panel_row2_col1"> <param name="entityName">results</param> <param name="headerFormat">$click.value$ : utilisation on $click.name2$</param> </module> <module name="HiddenChartFormatter" layoutPanel="panel_row2_col1"> <param name="chart">column</param> <param name="chart.stackMode">stacked</param> <param name="primaryAxisTitle.text">Hour</param> <param name="secondaryAxisTitle.text">MBytes downloaded</param> <param name="legend.placement">none</param> <module name="FlashChart"> <param name="width">100%</param> <param name="height">320px</param> <param name="enableResize">False</param> </module> </module> <!-- end chart stuff --> </module> <!-- end c2i click.value --> </module> <!-- end C2I click.value2 --> </module> <!-- end HiddenSearch --> </module> <!-- end simple results drilldown --> </module> <!-- end hidden post process--> </module> <!-- End HiddenSearch (or drilldown table postprocess) --> ... View more

Thanks. Works well, although getting into the guts of CSS is something I was hoping to avoid. ... View more

OK, so I played around an piping into eval started working. Go figure. Here's my current solution: search and filter on Category | stats first(_time) as timestr, values(Y) as y, sum(X) as x by date_year, date_month, date_mday, date_hour, SubCategory | convert timeformat="%Y-%m-%d %H:00" ctime(timestr) as DateTime | stats sum(y) as y, sum(x) as x by DateTime, SubCategory | eval r=x/y | chart sum(r) by DateTime, SubCategory The raw data is grouped into 300s clumps comprising several thousand unique events. The first stats command creates the period over which the summaries are built and includes a timestamp which is used by the second stats to build the actual table. Then we eval the average and pipe into chart to produce something that can be put into a graph. This allows me to keep or drop the SubCategory grouping in the second stats and the chart clauses and calculate the correct average over the Category. By using stats I've lost the event timestamp so needed to manually re-insert it. I works, but not as nicely as timechart as the X-Axis strings are quite long and a bit ugly when plotting over a week (168 points per series). Changing it to summarise over different time periods would involve changing the 2nd and 3rd lines. ... View more

I did try that. I was expecting that the first stats would generate a table which can be piped onwards through more functions so I could generate averages over that summary table (4 or 5 rows) however I cant get the value of 'r' to appear anywhere. Piping the above into another stats results in no results. ... View more