Splunk Search

How to draw multiple line using chart over date.

royimad
Builder

I'm trying to draw a chart using multiple line for each DeviceSubType without using timechart , i need to use chart over date.

The code:


Last 24 hours

sourcetype="DevicesReads" | eval devices_collection_date=collection_date | eval onlinereads=NbrOnlineReads | fields DEVICE_ID, onlinereads , devices_collection_date
| JOIN type=left DEVICE_ID
[ search sourcetype="DevicesInfo" $locations$ AND $series$
| fields DEVICE_ID, ExpectedNumberOfReadsPerDay, DeviceSubType, collection_date ]
| table DEVICE_ID, Location, DeviceSubType, ExpectedNumberOfReadsPerDay, onlinereads, collection_date, devices_collection_date
| eval Uptime=if(onlinereads>ExpectedNumberOfReadsPerDay,1,onlinereads/ExpectedNumberOfReadsPerDay) | eval time=strptime(devices_collection_date,"%Y%m%d") | convert TIMEFORMAT="%Y-%m-%d" ctime(time) AS date
| chart eval(avg(Uptime)*100) over date BY DeviceSubType

               <module name="HiddenChartFormatter">
                    <param name="chart">line</param>
                    <param name="chart.nullValueMode">zero</param>
                    <param name="primaryAxisTitle.text">Time</param>
                    <param name="secondaryAxisTitle.text">Uptime Reports</param>
                    <module name="JobProgressIndicator"/>
                    <module name="FlashChart">
                      <param name="width">100%</param>
                      <param name="height">200px</param>
                    </module>
                  </module>

      </module>
Tags (3)
0 Karma
1 Solution

royimad
Builder

This is resolved with the following peace of cake:

| chart eval(avg(Uptime)*100) over date BY DeviceSubType

Chart showing uptime of different devices series
line
zero
Time
Series Uptime


100%
400px

View solution in original post

0 Karma

royimad
Builder

This is resolved with the following peace of cake:

| chart eval(avg(Uptime)*100) over date BY DeviceSubType

Chart showing uptime of different devices series
line
zero
Time
Series Uptime


100%
400px

0 Karma
Get Updates on the Splunk Community!

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Combine Multiline Logs into a Single Event with SOCK: a Step-by-Step Guide for ...

Combine multiline logs into a single event with SOCK - a step-by-step guide for newbies Olga Malita The ...

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...