I have a splunk query of the following:
<searc> | timechart avg(cache_size) by host_instance
That will give me the average cache size per day. However I want to use the time metric for the log to visualize how much of each "host_instance" cache is being used at a certain time. Ideally I would l like to look at this chart and see how much cache was used by instance "a" (and all other instances) at a certain time.
Adjust the timespan. 1h
, 30m
, 15m
should be viable ...
your search | timechart span=1h avg(cache_size) by host_instance
Charts have limits on how many points they can show, that's why it advisable to use an aggregation command to reduce the number of points plotted (see this for limits: http://docs.splunk.com/Documentation/SplunkCloud/6.6.1/Viz/ChartDisplayissues#Searches_with_non-tran...). You may be able to avoid using aggregation command and using just simple table command to show all points. How many events you've with our base search ?
would values(cache_size)
or list(cache_size)
be what you are looking for? or perhaps |bucket _time span=1d |table _time host_instance cache_size
but bucket by 1d, 1h, etc., depending on what you need
otherwise, if you could more clearly define the expected output, that would be very helpful
Also, if you could maybe mock up what that shows that isn't what you need, and what you'd like instead?