Display calculated values in a timechart

Question

We have data in the summary index that counts information by various categories. For the purposes of presenting the problem we collect information in 15-minute buckets, and each event includes HostName, HostType, and count which is the number of occurrences of the HostName, HostType combination in that bucket. So a sample event would be

08:15:00 ... HostName="Alpha" HostType="foo" count=47 ...

HostNames can be any of a variety of Strings, and HostType can be either "foo" or "bar". I am trying to write a search that plots the percentage of "foo" in each bucket using a timechart. So far we have

index=summary 
| bucket span=15m _time 
| eval NumFoo=if(match(Node_Type,"foo"),count,0) 
| eval NumBar=if(match(Node_Type,"bar"),count,0) 
| eval PercentFoo=(NumFoo/(NumFoo+NumBar)) 
| timechart span=15m PercentFoo

As written, Splunk complains that "The specifier 'Offload' is invalid. It must be in form (). For example: max(size)." If I remove the timechart of the search above and instead pipe to | chart max(NumFoo), max(NumBar), max(PercentFoo) by _time I can see values for NumFoo and NumBar so the variables seem to be populated. I don't think using timechart max(PercentFoo) or any other operation on PercentFoo is appropriate - I have a value calculated I just need to display it. Any guidance on how to accomplish this is greatly appreciated.

Accepted Answer

It's a little strange to do the bucketing manually and then give it to timechart who'll want to bucket it again. But you could maybe replace the timechart with stats first(PercentFoo) as PercentFoo first(PercentBar) as PercentBar by _time. Since the first bucket will have done the bucketing, timechart and it's second span=15m clause isnt going to do anything anyway that the stats clause wouldnt do.

Or maybe you could not do the initial bucketing but leave the work to timechart. This is the way I would go:

index=summary (HostType="foo" OR HostType="bar" ) | timechart count span=15m by HostType

a nice stacked area chart of that might be all you need, but you could also do this:

index=summary (HostType="foo" OR HostType="bar" ) | timechart count span=15m by HostType | addtotals | eval=fooPercent=foo*100/Total | eval barPercent=bar*100/Total

Answer 2

0

I believe you should be able to do:

index=summary | timechart span=15m sum(count) by Node_Type | eval PercentFoo=foo/(foo+bar)

though if your example is too much simplified from your actual use case, there will have to be some adjustments made to make this work.

link

answered 26 Jan '11, 16:36

gkanapathy ♦
26.2k●1●6●22
accept rate: 42%

Display calculated values in a timechart

Follow this question

Splunk Resources

Related questions