Alerting

Creating per-server report

neil_craig
Engager

Hello all

I'm trying to create a report in Splunk (4.3.4). I can get the fields i want into a table but can't format a graph in the way i would like, this is what i'd really appreciate help with.

So i am ending up with 3 fields:
datetime (e.g. "2012-12-11 09:01:02")
serverName (e.g. "clientRef-host1")
numErrors (e.g. 1234)

What i would like is to have a line chart (although another type is fine if it displays the information logically) which shows:
x axis: datetime
y axis: numErrors
Lines: one line per serverName

If anyone can offer advice on how to achieve this, i'd be very grateful - i though it would be simple but it's eluded me thus far!

Many thanks
Neil

Tags (1)
0 Karma

lguinn2
Legend

Here's one idea:

... | timechart span=1h sum(numErrors) as ErrorCount by serverName 

This will show one line for each server. Each point on the line will represent one hour of errors.

If you want more suggestions, we need a little more information, like - how did you get the three fields? What does the source look like?

HTH!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...