Splunk Search

Maniupulating _time to remove 0 values from line chart

ericwindmill
Observer

I have a line chart in which I'm trying to monitor response time for a certain network call. I want to see the average response time, over time, by platform in a line chart.

Input data looks something like this:

network call #response time (ms)platform

1

200web
2250android
3300web
 140ios

 

and my current query looks like this:

 

index=myindex
| search mysearch
| spath response_time 
| spath input=request_payload output=platform path=client_properties.platform
| streamstats avg(response_time) as platform_response_time by platform time_window=10m
| chart first(platform_response_time) over _time by platform

 

 

This is getting my pretty close, but theres something about it that isn't "right" :

Screen Shot 2020-12-08 at 10.21.53 AM.png

What can I do to make the line's... better? I don't even know how to phrase this, but there shouldn't be 0 values. The lines shouldn't be jumping up and backdown to 0 at every tick. They should be more "straight". The problem, I think, is that I'm creating a point for each interval of time, and there isn't a request for every platform at every interval. 

Is there a way to group time intervals together in a longer period of time? i.e. there will only be a plot point for the average repsonse time each 5 minute interval? If there are truly 0 requests in 5m from a platform, that should be reflected, but it isn't likely and wouldn't happen so often.

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use the timechart command and adjust the span until the zeros disappear.

index=myindex
| search mysearch
| spath response_time 
| spath input=request_payload output=platform path=client_properties.platform
| streamstats avg(response_time) as platform_response_time by platform time_window=10m
| timechart span=10m first(platform_response_time) by platform
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Enter the Dashboard Challenge and Watch the .conf24 Global Broadcast!

The Splunk Community Dashboard Challenge is still happening, and it's not too late to enter for the week of ...

Join Us at the Builder Bar at .conf24 – Empowering Innovation and Collaboration

What is the Builder Bar? The Builder Bar is more than just a place; it's a hub of creativity, collaboration, ...

Combine Multiline Logs into a Single Event with SOCK - a Guide for Advanced Users

This article is the continuation of the “Combine multiline logs into a single event with SOCK - a step-by-step ...