Timecharting multiple lines..!

[minkyuk]

Hello, I have a question regarding timecharting multiple lines on one chart by Datacenter, but x-axis being Metric time and Y-axis being usedpct.

DATACENTER METRIC_DATE USEDPCT
Seoul, Korea 1393390800.000 59.1
Busan, Korea 1393390800.000 5.6
Seoul, Korea 1393477200.000 62.4
Busan, Korea 1393477200.000 5.31
Seoul, Korea 1393563600.000 59.4
Busan, Korea 1393563600.000 3.66
...
How could I accomplish this?

|inputlookup foo.csv|timechart span=86400s max(USEDPCT) by DATACENTER gives me no result for some reason

I would appreciate your help-

Jack

[woodcock]

You have the correct search but your input file is NOT a csv, it is a tsv, which Splunk cannot handle directly on-the-fly. You can handle it by adding a full-blown monitor input with inputs.conf and props.conf (which can be programmed to tell Splunk it is a tsv) or you can change the file by swapping the tabs for commas; then it will work. Short of that, we have to start from scratch and work with the _raw event because the automatic csv-based field extractions are hopelessly broken.

Ignoring the timestamp, you can make it work like this:

| inputlookup foo.csv | rex "(?<DATACENTER>\S+\s+\S+)\s+(?<METRIC_DATE>\S+)\s+(?<USEDPCT>.*)" | stats max(USEDPCT) BY DATACENTER

Trying to use time, this should work:

| inputlookup foo.csv | rex "(?<DATACENTER>\S+\s+\S+)\s+(?<METRIC_DATE>\S+)\s+(?<USEDPCT>.*)" | eval _time=METRIC_DATE | timechart span=86400s max(USEDPCT) BY DATACENTER

[jimodonald]

I suspect that Splunk does not know that "METRIC_DATE" is a time parameter. Try it this way:

| inputlookup foo.csv | rename METRIC_DATE as _time | timechart span=1d max(USEDPCT) by DATACENTER

[alacercogitatus]

The problem is with your data. You have commas , in the Datacenter field. Which in effect makes DATACENTER equal to Seoul or Busan and Metric_date equal to Korea.

You can fix this by updating the header of the CSV file to dc_city,dc_country,metric_date,usedpct, and then do this search:

|inputlookup foo.csv|eval DATACENTER = dc_city.", ".dc_country | timechart span=86400s max(USEDPCT) by DATACENTER

If you don't want to change the header, then you need to change the data.

"Seoul, Korea", 1393563600.000, 59.4

[minkyuk]

My datacenter string is already "Seoul, Korea" so I'm assuming it's treated as one..

[minkyuk]

Thank you, got it to work.
By any chance, I'm getting OTHER field since I have 10+ different datacenters, but how could I drill-down or change settings to prevent Splunk from making OTHER automatically

[dflodstrom]

add useother=f to the timechart portion of your query. use limit=x to limit your results.