Splunk Search

How to draw multiple line using chart over date.

royimad
Builder

I'm trying to draw a chart using multiple line for each DeviceSubType without using timechart , i need to use chart over date.

The code:


Last 24 hours

sourcetype="DevicesReads" | eval devices_collection_date=collection_date | eval onlinereads=NbrOnlineReads | fields DEVICE_ID, onlinereads , devices_collection_date
| JOIN type=left DEVICE_ID
[ search sourcetype="DevicesInfo" $locations$ AND $series$
| fields DEVICE_ID, ExpectedNumberOfReadsPerDay, DeviceSubType, collection_date ]
| table DEVICE_ID, Location, DeviceSubType, ExpectedNumberOfReadsPerDay, onlinereads, collection_date, devices_collection_date
| eval Uptime=if(onlinereads>ExpectedNumberOfReadsPerDay,1,onlinereads/ExpectedNumberOfReadsPerDay) | eval time=strptime(devices_collection_date,"%Y%m%d") | convert TIMEFORMAT="%Y-%m-%d" ctime(time) AS date
| chart eval(avg(Uptime)*100) over date BY DeviceSubType

               <module name="HiddenChartFormatter">
                    <param name="chart">line</param>
                    <param name="chart.nullValueMode">zero</param>
                    <param name="primaryAxisTitle.text">Time</param>
                    <param name="secondaryAxisTitle.text">Uptime Reports</param>
                    <module name="JobProgressIndicator"/>
                    <module name="FlashChart">
                      <param name="width">100%</param>
                      <param name="height">200px</param>
                    </module>
                  </module>

      </module>
Tags (3)
0 Karma
1 Solution

royimad
Builder

This is resolved with the following peace of cake:

| chart eval(avg(Uptime)*100) over date BY DeviceSubType

Chart showing uptime of different devices series
line
zero
Time
Series Uptime


100%
400px

View solution in original post

0 Karma

royimad
Builder

This is resolved with the following peace of cake:

| chart eval(avg(Uptime)*100) over date BY DeviceSubType

Chart showing uptime of different devices series
line
zero
Time
Series Uptime


100%
400px

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...