Splunk Search

2 searches 1 graph?

yumology
Path Finder

I'm having trouble conceptualizing how to have two or more lines that represent data on a single line chart.

For instance I'd like all these lines overlayed upon each other on a single line chart,
One line will be the exact value of something over the last hour.
"earliest=-1h | timechart span=15s max(myValue)"

Another line will be the lowest value that was reached in the last 24 hours.
"earliest=-24h | timechart span=24h min(myValue)"

While yet a 3rd line will be the average value for the last 7 days.
"earliest=-7d | timechart span=7d avg(myValue)"

And even a 4th line which is the values from yesterday in this same hour...
"earliest=-24h | timechart max(myValue) "???

I can't figure out what single search can do this but I can certainly make this happen with multiple searches so I wonder if I can have one graph display results of all 3 but limiting the time just the last hour?

Ledion_Bitincka
Splunk Employee
Splunk Employee

Ahh, you should be able to do that using the append command, there are examples in the SplunkDeploymentMonitor app that do this. Let's assume you want to compare today with the same day last week, then the basic idea is as follows:

search .... | timechart span=1h count | eval marker="Today" [search earliest=-7d@h latest=-6d@h ... | timechart span=1h count | eval marker="LastWeek" | eval _time =_time+86400*7] | timechart span=1h sum(count) AS count BY marker

Note: we need to add 86400*7 to the timechart results of last week so that we can overlap the last week's timechart onto the today's.

0 Karma

Ledion_Bitincka
Splunk Employee
Splunk Employee

You can easily do multiple lines in timecharts, however it seems like you want the timechart buckets to be different for each line, which would mean that you need multiple X-axis - something that is not very common. Anyways, here is how to do multiple series in one chart:

.... | timechart max(field) AS max, min(field) AS min,  avg(field) as avg 

yumology
Path Finder

I know about doing it that way. But I'm wondering how to change the time constraint and do a search on that, and display a value from that.

I swear I saw an example somewhere that had a graph of web analytics where it was comparing current number of things bought compared to average number of things bought on this day of the week.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...