Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About n0cturne
n0cturne
Loves-to-Learn
Member since:
07-02-2021
10-01-2021
Community Statistics
| Posts | 5 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 07-02-2021 |
Activity Feed
- Posted Re: Timechart - Same time range and span but different timeline on Splunk Search. 09-30-2021 11:18 AM
- Posted Re: Timechart - Same time range and span but different timeline on Splunk Search. 09-30-2021 08:08 AM
- Posted Timechart - Same time range and span but different timeline on Splunk Search. 09-30-2021 07:35 AM
- Posted Re: Sum last count over servers and time chart on Dashboards & Visualizations. 07-02-2021 03:27 AM
- Posted Sum last count over servers and time chart on Dashboards & Visualizations. 07-02-2021 02:31 AM
Topics I've Started
09-30-2021
11:18 AM
Here are my panels and settings. inputs: <input type="time" token="time_infra">
<label>Time Range</label>
<default>
<earliest>-48h</earliest>
<latest></latest>
</default>
</input>
<input type="dropdown" token="span" searchWhenChanged="false">
<label>Span</label>
<choice value="1m">1 min</choice>
<choice value="5m">5 min</choice>
<choice value="15m">15 min</choice>
<choice value="30m">30 min</choice>
<choice value="1h">1 hour</choice>
<choice value="2h">2 hours</choice>
<choice value="4h">4 hours</choice>
<choice value="8h">8 hours</choice>
<choice value="12h">12 hours</choice>
<choice value="1d">1 day</choice>
<choice value="1w">1 week</choice>
<default>5m</default>
<initialValue>5m</initialValue>
</input>
<input type="dropdown" token="refresh_rate">
<label>Refresh rate</label>
<choice value="1m">1 min</choice>
<choice value="3m">3 min</choice>
<choice value="5m">5 min</choice>
<choice value="10m">10 min</choice>
<choice value="15m">15 min</choice>
<choice value="30m">30 min</choice>
<choice value="1h">1 h</choice>
<default>10m</default>
<initialValue>10m</initialValue>
</input> top chart: <panel id="heap_back">
<html>
<style>
#heap_back{
width:30% !important;
}
</style>
</html>
<chart>
<title>....Backend</title>
<search>
<query>index=ascrm sourcetype=jmx heap_used=* heap_max=* crm_tier=backend
| fields host,heap_used,heap_max
| eval hu=100/heap_max*heap_used
| rex field=host "(?<hostname>[^.]+)\."
| timechart span=$span$ eval(round(p99(hu),0)) by hostname</query>
<earliest>$time_infra.earliest$</earliest>
<latest>$time_infra.latest$</latest>
<sampleRatio>1</sampleRatio>
<refresh>$refresh_rate$</refresh>
<refreshType>delay</refreshType>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisLabelsY.majorUnit">10</option>
<option name="charting.axisTitleX.visibility">collapsed</option>
<option name="charting.axisTitleY.visibility">collapsed</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.abbreviation">none</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.abbreviation">none</option>
<option name="charting.axisY.maximumNumber">100</option>
<option name="charting.axisY.minimumNumber">0</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.abbreviation">none</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">line</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">connect</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">none</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.mode">seriesCompare</option>
<option name="charting.legend.placement">right</option>
<option name="charting.lineWidth">2</option>
<option name="height">300</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
</chart>
</panel> bottonm chart: <panel id="gc_back">
<html>
<style>
#gc_back{
width:30% !important;
}
</style>
</html>
<chart>
<title>....Backend</title>
<search>
<query>index=ascrm sourcetype=crm_log_gc crm_tier=backend "Pause Full (Diagnostic Command)"
| timechart span=$span$ count by host</query>
<earliest>$time_infra.earliest$</earliest>
<latest>$time_infra.latest$</latest>
<sampleRatio>1</sampleRatio>
<refresh>$refresh_rate$</refresh>
<refreshType>delay</refreshType>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">collapsed</option>
<option name="charting.axisTitleY.visibility">collapsed</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.abbreviation">none</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.abbreviation">none</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.abbreviation">none</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">line</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">connect</option>
<option name="charting.chart.showDataLabels">minmax</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">none</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.mode">seriesCompare</option>
<option name="charting.legend.placement">right</option>
<option name="charting.lineWidth">2</option>
<option name="height">300</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
</chart>
</panel> It seem all to be correct. But the charts haven't synchonous timelines.
... View more
09-30-2021
08:08 AM
Both timecharts are using a global time token (7d in this case) and span=1d. I've expected, that both x-axis were matching.
... View more
09-30-2021
07:35 AM
Hello, i've put two timecharts on top of each other to compare their events by time. Both timecharts are using the same time range and span. The top timechart has many data points whereas the bottom has just a few. How can I show the same time range on the x-axis in both timecharts?
... View more
Labels
- Labels:
-
timechart
07-02-2021
03:27 AM
I want to trend against the value x hours ago. I have a time picker with token. This time token shoul be used to define x.
... View more
07-02-2021
02:31 AM
Hello, I have 5 Servers. Every server has an actual count of user sessions. I want them to sum up, without loosing the trend funcion in the single value chart. This is my actual query: index=ascrm sourcetype=jmx NumUiSessions=* host IN (z1il0095*,z1il0096*,z1il0097*,z1il0098*)
| stats latest(NumUiSessions) as latest_NumUiSessions by host
| stats sum(latest_NumUiSessions) AS UISessions Could anyone give me a clou? Best regards Benjamin
... View more
Labels
- Labels:
-
chart
-
single value
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-01-2021
05:04 AM
|
