Splunk Search

timechart 2 different fields in one search

sbattista09
Contributor

I seem to be having issues with time charting, i want to get a trend over time for more then one field. I have tried a few different ways but can get my head around it. I would like to build this off of the example below.

Example "This is in a stacked Column view" -
index=index1 |eval RISK=case(RISK==4,"High",RISK==5,"Severe") |chart count by SUBCATEGORY,RISK useother=f usenull=f

let me know if you need anymore information, i know this is a pretty general question.

thanks!

0 Karma
1 Solution

fdi01
Motivator

use simplily timechart command. is this show you dynamic chart of this two host on times..

index=index1 |eval RISK=case(RISK==4,"High",RISK==5,"Severe") |timechart count by RISK, SUBCATEGORY useother=f usenull=f
or
index=index1 |timechart count(eval RISK=4) as "High" count(eval RISK=5) as "Severe" by SUBCATEGORY useother=f usenull=f

View solution in original post

sbattista09
Contributor

still getting odd results-

|timechart count(eval RISK=4) as "High" count(eval RISK=5) as "Severe" by SUBCATEGORY useother=f usenull=f gave me a chart however it did not count anything, all the results were 0.

|eval RISK=case(RISK==4,"High",RISK==5,"Severe") |timechart count by RISK, SUBCATEGORY useother=f usenull=f gave me "Error in 'timechart' command: The argument 'SUBCATEGORY' is invalid."

Thanks for the help!

0 Karma

fdi01
Motivator

use simplily timechart command. is this show you dynamic chart of this two host on times..

index=index1 |eval RISK=case(RISK==4,"High",RISK==5,"Severe") |timechart count by RISK, SUBCATEGORY useother=f usenull=f
or
index=index1 |timechart count(eval RISK=4) as "High" count(eval RISK=5) as "Severe" by SUBCATEGORY useother=f usenull=f

sbattista09
Contributor

thanks,

however i wanted to turn this into a time chart to see a trend over time. Do you think this would be possible ?

0 Karma

rsennett_splunk
Splunk Employee
Splunk Employee
index=index1 
|chart count(eval RISK=4) as "High" count(eval RISK=5) as "Severe" by SUBCATEGORY useother=f usenull=f
With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...