Dashboards & Visualizations

graph or report based on value?

tinhuty
Engager

new to splunk, sorry if this is trivial.

by default the timeline graph are draw based on number of occurrence. I want something different.

say my log entry are like this:

Timestamp=2011/11/30 15:31:32.424, Timespent=0.4063
Timestamp=2011/11/30 15:24:16.653, Timespent=1.0156
Timestamp=2011/11/30 15:17:01.522, Timespent=0.4219
Timestamp=2011/11/30 15:09:28.907, Timespent=0.1250
Timestamp=2011/11/30 15:02:09.526, Timespent=0.1406
Timestamp=2011/11/30 14:55:10.615, Timespent=0.6875

1). is it possible to create report/graph using Timestamp field as X-axis and Timespent field as Y-axis?
2). how to create report that shows number of records(or percentage) that Timespent values are between 0-0.5 and 0.5-1.0 etc?

Thanks.

Tags (1)
0 Karma

Ayn
Legend

Sure. Use timechart!

First, some explanation on how timechart behaves: timechart needs some kind of statistical function that returns a unique value for the timespan it's operating on. If you don't define the timespan yourself it will be set dynamically depending on what timerange the whole search spans, but let's take an example where the timespan is 1 minute and that somewhere in your log you have 3 of these events occurring within 1 minute. Splunk needs to know how to give you ONE value for "Value", even though there are 3 values of each. You can tell Splunk to just give you an average from the 3 events using the stats function avg:

... | timechart span=1m avg(Timespent) as Timespent

Or, if you only want the values from the first of the events within the time period, use first instead of avg. Want the sum? Use sum. And so on. More information on statistical functions is available here: http://www.splunk.com/base/Documentation/latest/SearchReference/Stats

There's also a second way to do this, which is to produce a table containing timestamps and values yourself and then feed them into the chart.

... | table _time Timespent

As for the second question, you can achieve this by using bucket to divide Timespend into the intervals you want. Like this:

... | bucket Timespent span=0.5 | stats count by Timespent
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...