Splunk Search

Graph from key/value pairs

mateibos
New Member

Hello,

I am extracting from a database the list of the largest 20 tables. The format would be something like =:

For example:

TableSizeMB
LargestTable=2012
VeryLargeTable=2008
SomeTable=500

Obviously, the list is not fixed as some tables might become larger and make it to the list while others would disappear.

Would it be possible to have a graph of these tables and their sizes? If yes, how should I define the search?

Thank you in advance.

0 Karma

DalJeanis
Legend

As far as the search, it's pretty much trivial

your search that gets tablename and tablesize
| sort 20 - tablesize

If you want to display all 20, then in splunk I'd suggest using a horizontal bar chart. Here's some run-anywhere sample code so you can see what it looks like.

| makeresults | eval junk=mvrange(1,25) | mvexpand junk | eval tablename="T".junk | eval tablesize = random()%125 + random()%221 | sort 20 - tablesize | table tablename tablesize
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...