I have difficulties to create a simple, unidimentional histogram. Suppose you have a log similar to this:
host=host1 sent=1 received=2
host=host2 sent=3 received=3
host=host1 sent=18 received=1
I'd like to create a simple histogram displaying the total amount of "sent" and "received", no matter what host.
The following search command doesn't give expected results because I end up with a single column with the value of 6 ("sum(received)") :
host=host* | chart sum(sent), sum(received)
What's wrong with my search?
Edit
Added pictures to clarify my question
Table view (correct):
Chart view (not correct ? or at least not what I would expect):
AH! OK. In a previous answer, by "columns" you meant columns in a chart and I thought you meant columns as in a table. So we were both right.
Indeed, the chart here is misinterpreting what you want. In a chart each row is a data point, the first value in that row is the main x-axis value, and any subsequent values are taken as the one or more series to be charted.
The simplest way to fix this is to tack on a transpose command to give chart data it can interpret correctly:
| chart sum(sent), sum(received) | transpose | rename column as type "row 1" as bytes
AH! OK. In a previous answer, by "columns" you meant columns in a chart and I thought you meant columns as in a table. So we were both right.
Indeed, the chart here is misinterpreting what you want. In a chart each row is a data point, the first value in that row is the main x-axis value, and any subsequent values are taken as the one or more series to be charted.
The simplest way to fix this is to tack on a transpose command to give chart data it can interpret correctly:
| chart sum(sent), sum(received) | transpose | rename column as type "row 1" as bytes
Thanks both for the explanation and the solution
Here's a search, loosely based on documentation:
host=host* | chart sum(sent) AS sumsent, sum(received) AS sumreceived by _time | eval s1="Sent Received" | makemv s1 | mvexpand s1 | eval yval=case(s1=="Sent",sumsent,s1=="Received",sumreceived) | chart sum(yval) AS Sum by s1
Documentation link:
http://docs.splunk.com/Documentation/Splunk/5.0.4/Search/Chartmultipledataseries
Works perfect. I would have thought there was a simpler way though.