Splunk Search

TimeChart by 2 fields

Gulrez
Engager

I am trying to create a timechart by 2 fields
Here is what I tried:
source=abc CounterName="\Process(System)\% Processor Time"| timechart span=1h avg(CounterValue) by RoleInstance CounterName

Any idea how this could be achieved?

Tags (1)

shahab1khan
Engager

how about

source=abc CounterName="\Process(System)\% Processor Time" | stas count by RoleInstance,CounterName

view the visualization tab to get charts afterwards

0 Karma

shahab1khan
Engager

You can use the following and view the visualization tab

|stats count by field1,field2

asifpasha23
New Member

span is not working with chart. But I tried something below which works for me
chart perc90(s), count(s) by host

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Something like this

source=abc CounterName="\Process(System)\% Processor Time" | eval Role_Counter=RoleInstance + "#" + CounterName| timechart span=1h avg(CounterValue) by Role_Counter

MuS
SplunkTrust
SplunkTrust

timechart values(foo) by bar
Is the same like
chart values(foo) over_time by bar
But like linu said chart can have more then one by clause

0 Karma

rvany
Communicator

This is an older one - but for reference:

I don't think, that this is completely true. chart can have a and a . It's more flexible than timechart as the can be something other than _time. But you only have these to split-options (I believe, it was the same in 2014 with version 6.0.# or older).

If I'm wrong, just tell me so I can learn more and more...

0 Karma

linu1988
Champion

chart does support more fields. why to limit urself with timechart. They almost do the same.

somesoni2
SplunkTrust
SplunkTrust

Time chart just work with one field in "by" clause. You can concatenate multiple field into one and use in timechart.

0 Karma

Gulrez
Engager

Can we scale this to more than 2 fields?

0 Karma

linu1988
Champion

or bucket _time span=1h|chart avg(CounterValue) by RoleInstance,CounterName

somesoni2
SplunkTrust
SplunkTrust

You can concat both the fields into one field and do a timechart on that.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...