Dashboards & Visualizations

How to chart multiple events greater and less than a field's value?

dwillsonnz
New Member

I'm trying to get a chart that displays the number of events where ProcessingTime was less than 1 second, between 1 and 2 seconds, and greater than 2 seconds within a certain time frame, and displaying that as 3 separate lines on a chart.

I can search for these stats individually:

search command ProcessingTime<1  | timechart span=10s count by _count 
search command ProcessingTime>1 ProcessingTime<2  | timechart span=10s count by _count 
etc

But what I want is multiple lines in one chart depending on which "bucket" the field value falls into. Unfortunately I'm not sure what I should be searching for to find what I want to do. Any tips?

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

Hi @dwillsonnz ,

Try

"search command" 
|timechart span=10s count(eval(if(ProcessingTime<1,ProcessingTime,null()))) as less_than_one,count(eval(if(ProcessingTime>1 AND ProcessingTime<2,ProcessingTime,null()))) as between_one_two ,count(eval(if(ProcessingTime>2,ProcessingTime,null()))) as above_two by _count

Reference : http://docs.splunk.com/Documentation/Splunk/7.1.2/Search/Usestatswithevalexpressionsandfunctions

Happy Splunking!

View solution in original post

0 Karma

niketn
Legend

While I would also use eval within transforming command, just throwing in the union command as another option which should work on Splunk 6.6 or higher.

PS: It will run on Search Head if the data sets of both sub-searches are non-streaming (in the following example because of timechart).

| union 
    [ search index=_internal sourcetype=splunkd log_level=ERROR 
    | timechart count as Error] 
    [ search index=_internal sourcetype=splunkd log_level=WARN 
    | timechart count as WARN]
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Hi @dwillsonnz ,

Try

"search command" 
|timechart span=10s count(eval(if(ProcessingTime<1,ProcessingTime,null()))) as less_than_one,count(eval(if(ProcessingTime>1 AND ProcessingTime<2,ProcessingTime,null()))) as between_one_two ,count(eval(if(ProcessingTime>2,ProcessingTime,null()))) as above_two by _count

Reference : http://docs.splunk.com/Documentation/Splunk/7.1.2/Search/Usestatswithevalexpressionsandfunctions

Happy Splunking!
0 Karma

dwillsonnz
New Member

This worked for me, and I had an easy time expanding this into a wider number of brackets as well, even if I don't fully understand the syntax yet! Thanks!

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@dwillsonnz , will try to breakdown the commands

1 . count() -- normal count
2 . count( eval() ) -- evaluate whats inside the bracket (similart to if)
3. count( eval( your condition ) ) => count(eval(range=="<1"))

So it evaluates the condition and its true, takes the first value, if not takes the second value which is null() in our case - in other words if the condition does not match, it does not consider any value

Happy Splunking!
0 Karma

niketn
Legend

@renjith.nair, as per the original question, I would add ProcessingTime<2 as filter in the base search and not use count(eval(if(ProcessingTime>2,ProcessingTime,null()))) as above_two by _count.

We can also use

<baseSearchFilters> ProcessingTime<2
| eval range=case(ProcessingTime<1,"<1",ProcessingTime>=1 AND ProcessingTime<2,">1 & <2")
| timechart span=10s count(eval(range=="<1")) as "<1" count(eval(range==">1 & <2")) as ">1 & <2" by _count

Both the query might have to be tested for performance as Built-in search optimization may change the resultant query being run which does processing to the same effect. Also depends on actual infrastructure i.e. whether indexers can handle more load or search heads. Refer to answer: https://answers.splunk.com/answers/661195/query-performance-question-using-pipe-vs-inline-fu.html

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@niketnilay, thanks for the hint, but i think he wants the result for >2 as well as per the question though only 2 are mentioned in SPL I'm trying to get a chart that displays the number of events where ProcessingTime was less than 1 second, between 1 and 2 seconds, and greater than 2 seconds within a certain time frame, and displaying that as 3 separate lines on a chart.

Happy Splunking!
0 Karma

niketn
Legend

@renjith.nair sorry I missed that in the question 🙂

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...