![]() ![]() This table, which is generated as a result of the command execution, can then be formatted in a way that is appropriate for the requirement, for example, chart visualization. The y-axis can be any other field value, count of values, or statistical calculation of a field value.įor more information, see the Data structure requirements for visualizations in the Dashboards and Visualizations manual.Įxample 1: This report uses internal Splunk log data to visualize the average indexing thruput (indexing kbps) of Splunk processes over time. The Splunk timechart command is used to produce the summary statistics table. When you use the timechart command, the x-axis represents time. Timechart visualizations are usually line, area, or column charts. ![]() Use the timechart command to display statistical trends over time You can split the data with another field as a separate series in the chart. This table can then be formatted as a chart visualization, where your data is plotted against an x-axis that is always a time field. The timechart command generates a table of summary statistics. Timechart will format the results into an x and y chart where time is the x -axis (first column) and our y-axis (remaining columns) will be a specified field Understanding these differences will prepare you to use the timechart command in Splunk without confusing the use cases. stats values (lastLogonTimestamp) as 'LastLogon. So lets say here the count should only be 3 (Host3,Host6,Host7) I tried doing this, but got no results: index'assets' sourcetype'ldap:devices'. For example, you can specify a time span like we have in this search. This topic discusses using the timechart command to create time-based reports. From this results I want to count on a timechart the hosts that had 3 or more lastlogon on the LastLogonCount field. The timechart command includes several options that are not available with the stats and chart commands.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |