Splunk Search

Graph from key/value pairs

mateibos
New Member

Hello,

I am extracting from a database the list of the largest 20 tables. The format would be something like =:

For example:

TableSizeMB
LargestTable=2012
VeryLargeTable=2008
SomeTable=500

Obviously, the list is not fixed as some tables might become larger and make it to the list while others would disappear.

Would it be possible to have a graph of these tables and their sizes? If yes, how should I define the search?

Thank you in advance.

0 Karma

DalJeanis
Legend

As far as the search, it's pretty much trivial

your search that gets tablename and tablesize
| sort 20 - tablesize

If you want to display all 20, then in splunk I'd suggest using a horizontal bar chart. Here's some run-anywhere sample code so you can see what it looks like.

| makeresults | eval junk=mvrange(1,25) | mvexpand junk | eval tablename="T".junk | eval tablesize = random()%125 + random()%221 | sort 20 - tablesize | table tablename tablesize
0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...