Getting Data In

How to graph with multiple fields by _time

it_systems
New Member

Hey community,

Browsed a lot of posts, but did not found any answer to my problem...

I have a sourcetype that give me this kind of results for a row, here is 3 exemples :

_time=2019-09-25T15:40:34.000+02:00,UP=45,WARN=12,DOWN=5
_time=2019-09-25T15:41:34.000+02:00,UP=43,WARN=14,DOWN=3
_time=2019-09-25T15:42:34.000+02:00,UP=45,WARN=12,DOWN=3

UP,WARN and DOWN values are a count of "status" (UP,WARN and DOWN) at _time (these results are retrieved through REST API sourcetype, so I cannot change anything at the indexing level)

I would like to build a graph showing "status" by _time

Unfortunately, it seems that a timechart can only be built based on some count() or avg() or sum() ... etc but since my values are already a count, what can be my options here? All my tries led to displaying incorrect data 😞

Thank you in advance!

0 Karma
1 Solution

jacobpevans
Motivator

Greetings @it_systems,

You need to use an aggregate function for timechart to work properly. There is no way around that. In your case, you'd want sum(). If you want to keep the same values - since your data points are 1 minute apart, use span=1m to force that. Here's a run-anywhere search so you can see what I mean (run it for the last 5 minutes):

           | makeresults | eval _time=now()-  0, UP=45, WARN=12, DOWN=5
| append [ | makeresults | eval _time=now()- 60, UP=43, WARN=14, DOWN=3 ]
| append [ | makeresults | eval _time=now()-120, UP=45, WARN=12, DOWN=3 ]
| append [ | makeresults | eval _time=now()-180, UP=0,  WARN=10, DOWN=20 ]
| append [ | makeresults | eval _time=now()-240, UP=50, WARN=50, DOWN=50 ]
| timechart span=1m sum(DOWN) as DOWN, sum(UP) as UP, sum(WARN) as WARN
Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.

View solution in original post

0 Karma

jacobpevans
Motivator

Greetings @it_systems,

You need to use an aggregate function for timechart to work properly. There is no way around that. In your case, you'd want sum(). If you want to keep the same values - since your data points are 1 minute apart, use span=1m to force that. Here's a run-anywhere search so you can see what I mean (run it for the last 5 minutes):

           | makeresults | eval _time=now()-  0, UP=45, WARN=12, DOWN=5
| append [ | makeresults | eval _time=now()- 60, UP=43, WARN=14, DOWN=3 ]
| append [ | makeresults | eval _time=now()-120, UP=45, WARN=12, DOWN=3 ]
| append [ | makeresults | eval _time=now()-180, UP=0,  WARN=10, DOWN=20 ]
| append [ | makeresults | eval _time=now()-240, UP=50, WARN=50, DOWN=50 ]
| timechart span=1m sum(DOWN) as DOWN, sum(UP) as UP, sum(WARN) as WARN
Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
0 Karma

it_systems
New Member

Thanks @jacobevans !

That did the trick 🙂

Thank you very much for your help!

0 Karma

jacobpevans
Motivator

You're welcome! Thank you for accepting the answer.

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...