Build a chart of multiple data series
Splunk transforming commands do not support a direct way to define multiple data series in your charts (or timecharts). However, you CAN achieve this using a combination of the stats
and xyseries
commands.
The chart
and timechart
commands both return tabulated data for graphing, where the x-axis is either some arbitrary field or _time
, respectively. When these commands are used with a split-by field, the output is a table where each column represents a distinct value of the split-by field.
In contrast, the stats
command produces a table where each row represents a single unique combination of the values of the group-by fields. You can then use the xyseries
command to redefine your data series for graphing.
For most cases, you can simulate the results of "... | chart n by x,y" with "... | stats n by x,y | xyseries x y n". (For the timechart
equivalent of results, x = _time
.)
Scenario
Let's say you want to report on data from a cluster of application servers. The events gathered from each server contain information such as counts of active sessions, requests handled since last update, etc. and are placed in the applications_servers
index. You want to display each server instance and the number of sessions per instance on the same timechart so that you can compare the distributions of sessions and load.
Ideally, you want to be able to run a timechart report, such as:
index=application_servers
| timechart sum(handledRequests) avg(sessions) by source
However, timechart does not support multiple data series; so instead, you need run a search similar to the following:
index=application_servers
| bin _time
| stats sum(handledRequests) as hRs, avg(sessions) as ssns by _time, source
| eval s1="handledReqs sessions"
| makemv s1
| mvexpand s1
| eval yval=case(s1=="handledReqs",hRs,s1=="sessions",ssns)
| eval series=source+":"+s1
| xyseries _time,series,yval
Walkthrough
Let's break this search down so it's easier to understand what each part of the search is doing:
The first thing that you need to do, before the stats
command, is to separate the events by time.
... | bin _time
The stats
command is used to calculate statistics for each source value: The sum of handledRequests
values are renamed as hRs
, and the average number of sessions
are renamed as ssns
.
... | stats sum(handledRequests) as hRs, avg(sessions) as ssns by _time, source
The following portion of the search uses the eval
command to add a single-valued field called "s1" to each result from the stats
command. Then, the makemv
command converts the values in the s1
field into a multivalued field, where the first value is "handledRequests" and the second value is "sessions". The mvexpand
command then creates separate series for each value of s1.
... | eval s1="handledRequests sessions" | makemv s1 | mvexpand s1
Then the search uses the eval
command to define a new field called "yval", and assign values to the field based on the case that it matches. So, if the value of s1 is "handledRequests", the yval
field is assigned the "hRs" value. And, if the value of the s1
field is "sessions", the yval
field is assigned the "ssns" value.
... | eval yval=case(s1=="handledRequests",hRs,s1=="sessions",ssns)
Then the search uses the eval
command to define a new field called "series", which concatenates the value of the sessions
and s1
fields.
... | eval series=source+":"+s1
Finally, the xyseries
command is used to define a chart with _time
on the x-axis, yval
on the y-axis, and data defined by the series
field.
... | xyseries _time, yval, series
See also
- Commands
- bin command in the Search Reference
- eval command in the Search Reference
- makemv command in the Search Reference
- mvexpand command in the Search Reference
- stats command in the Search Reference
- xyseries command in the Search Reference
Look for associations, statistical correlations, and differences in search results | Compare hourly sums across multiple days |
This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.0.10, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.1.6, 9.2.0, 9.2.1, 9.2.2, 9.2.3, 9.3.0, 9.3.1, 8.1.0, 8.1.10, 8.1.11, 8.1.12
Feedback submitted, thanks!