Dashboards & Visualizations

Display data from all host in timeline

mchandx
Path Finder

Hello,

I need to create a stacked area graph displaying all data for all hosts in the environment. I have the visualization created, but I do not know the proper syntax.

0 Karma

mchandx
Path Finder

That is essentially what I am looking for. I want to graph the amount of logs indexed per host since midnight of the current day, graphed by hosts.

So the graph the x-axis would show time and the y-axis would be an integer of how many total logs generated by the entire network. That integer would then be broken down by hosts. Here's a picture kind of showing the look that I am trying to achieve:
http://1.bp.blogspot.com/-OmyYzNNKZE0/Tmls2yFeGcI/AAAAAAAAABY/uCzqQxB3ZDE/s1600/Selection_015.png

0 Karma

mchandx
Path Finder

I tried that, and this is what I got:

http://i42.tinypic.com/3480l6o.png

The blacked out sections are hosts

0 Karma

cramasta
Builder

Then the example i provided will do just that. However beware of the timeframe that are are plotting agaist when using the span function. If you do

|timechart span=1m count by host

over the past 1 year there will not be enough room to plot all of the data points and the chart wont look right. You can just leave the span=1d part out all together and splunk will pick the correct grouping method

0 Karma

cramasta
Builder

Some more information on what type of data you are trying to display would help.

you could see how many events you are collecting by host over time by doing this

index=main * | timechart span=1d count by host

span=1d will show how many events each host collects for each date. You can change it to span=1h if you would like to see how much each collects in a hour

0 Karma

yannK
Splunk Employee
Splunk Employee

if you have a lot of hosts, to avoid having a column with "OTHERS" for the 10+ hosts.
You may want to add at the end : useother=0

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...