Dashboards & Visualizations

How do I plot 60 days worth of data on the line chart?

shanecifaldi
Loves-to-Learn Everything

I have data coming in from our NetApp storage controllers that shows aggregate space free every day. I need to plot each day's values and then show a chart that shows the last 60 days as dots on a line chart. Management wants to see if storage is trending up or down. i have this search so far but it is messing up and plotting the sum of all of them over 60 days. I want each day's values plotted:

index=netapp_vault_utilization sourcetype=dbx3_netapp_vault_aggregate earliest=-60d@d latest=@h 
| timechart span=60d@d sum(SpaceFree) AS aggregate_space_free_60d by name
| append [search index=netapp_vault_utilization sourcetype=dbx3_netapp_vault_aggregate earliest=-48h@h latest=24h@h
| timechart span=60d@d sum(SpaceFree) AS aggregate_space_free_60d by name]

alt text

It will show the correct amount for the current day but the larger numbers above are a sum of when the oldest event is. How did i fix this? Am i even on the right path?

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@shanecifaldi,

If you need to see daily growth, set the span to 1d span=1d which will split the data into "day" buckets.

index=netapp_vault_utilization sourcetype=dbx3_netapp_vault_aggregate earliest=-60d@d latest=@h 
| timechart span=1d sum(SpaceFree) AS aggregate_space_free_60d by name
Happy Splunking!

View solution in original post

renjith_nair
SplunkTrust
SplunkTrust

@shanecifaldi,

If you need to see daily growth, set the span to 1d span=1d which will split the data into "day" buckets.

index=netapp_vault_utilization sourcetype=dbx3_netapp_vault_aggregate earliest=-60d@d latest=@h 
| timechart span=1d sum(SpaceFree) AS aggregate_space_free_60d by name
Happy Splunking!

shanecifaldi
Loves-to-Learn Everything

Wow..something so simple, duh! Thanks for the help!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...