Splunk Search

Graph from key/value pairs

mateibos
New Member

Hello,

I am extracting from a database the list of the largest 20 tables. The format would be something like =:

For example:

TableSizeMB
LargestTable=2012
VeryLargeTable=2008
SomeTable=500

Obviously, the list is not fixed as some tables might become larger and make it to the list while others would disappear.

Would it be possible to have a graph of these tables and their sizes? If yes, how should I define the search?

Thank you in advance.

0 Karma

DalJeanis
Legend

As far as the search, it's pretty much trivial

your search that gets tablename and tablesize
| sort 20 - tablesize

If you want to display all 20, then in splunk I'd suggest using a horizontal bar chart. Here's some run-anywhere sample code so you can see what it looks like.

| makeresults | eval junk=mvrange(1,25) | mvexpand junk | eval tablename="T".junk | eval tablesize = random()%125 + random()%221 | sort 20 - tablesize | table tablename tablesize
0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...