Splunk Search

Multiple Series Line Chart Dashboard

vtrujillo
Explorer

Hi everyone!

I'm trying to add a new series to my line chart from my dashboard's xml file. (Which means I want to display 2 lines on my chart).

So far I have the following:

<?xml version='1.0' encoding='utf-8'?>
<dashboard>
  <!--
NOTE: This file was automatically generated by Splunk.  Use caution when editing manually.
-->
  <label>SLU CPU PERFORMANCE</label>
  <row>
    <chart>
      <option name="charting.chart">line</option>
      <searchString>source="*slu*" CPU_IDLE_USAGE="*" | timechart max(CPU_IDLE_USAGE)</searchString>
      <title>CPU PERFORMANCE</title>
      <option name="drilldown">all</option>
    </chart>
  </row>
  <row>
    <table>
      <searchString>source="*slu*" CPU_IDLE_USAGE="*"</searchString>
      <title>Results</title>
      <option name="drilldown">row</option>
    </table>
  </row>
</dashboard>

... and I would like to add the CPU_SYS_USAGE="*" field as a series to this chart.

Thank you in advance.

Bye!

Tags (2)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

I suppose all you should need to do is use:

source=*slu* | timechart max(CPU_IDLE_USAGE) max(CPU_SYS_USAGE)

(or average(CPU_SYS_USAGE) or some other aggregator function besides max() if you prefer).

View solution in original post

p1rate5s
Explorer

Use max() and set the span to be lower than the time between data points so you only capture one data point in a span.

vtrujillo
Explorer

Thanks!

Now, what if I don't want to plot a max() or an avg()?

I just want to show the numbers that CPU_IDLE_USAGE have. For example:

_time              CPU_ID CPU_IDLE_USAGE 
8/23/10 11:25:00.000 PM 0 90 
8/23/10 11:20:00.000 PM 0 83 
8/23/10 11:15:00.000 PM 0 81 
8/23/10 11:10:00.000 PM 0 82 
8/23/10 11:05:00.000 PM 0 88 
8/23/10 11:00:00.000 PM 0 78 

I would like to plot the following values: 90, 83, 81, 82, 88... etc. How can I do that?

Thank you again

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

I suppose all you should need to do is use:

source=*slu* | timechart max(CPU_IDLE_USAGE) max(CPU_SYS_USAGE)

(or average(CPU_SYS_USAGE) or some other aggregator function besides max() if you prefer).

View solution in original post

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!