Splunk - Group X-axis elements together
I have this chart in a Splunk dashboard
The x-axis refers to the different hosts executing our BAU Process. The y-axis refers to the time taken for the BAU Process to finish
The code to generate the chart is
(host = "A" OR host = "B" OR host = "C" OR host = "D" OR host = "E" OR host = "F" OR host = "G" OR host = "H")
AND source = "logs/BAU.log"
| transaction submission_id startswith="ABC Logic begins" endswith="ABC Logic ended"
| chart avg(duration) by host
I would like to group the hosts into 2 main groups: "Primary" & "Secondary"
Hosts "A", "B", "C", "D" should be in "Primary"
Hosts "E", "F", "G", "H" should be in "Secondary"
So the chart should be:
- Y-axis - average execution time of the group
- X-axis - group
Would anyone be able to assist me with this? I've tried Googling but I can't quite seem to hit the correct results, thanks
You want to chart by group instead of host.
You can use eval command with an if function to create a field with a value that is either Primary or Secondary by testing whether the host value is in the list of Primary values using an if condition, then plot by group:
(host = "A" OR host = "B" OR host = "C" OR host = "D" OR host = "E" OR host = "F" OR host = "G" OR host = "H") AND source = "logs/BAU.log"
| transaction submission_id startswith="ABC Logic begins" endswith="ABC Logic ended"
| eval group = if (host in ("A", "B", "C", "D"), "Primary", "Secondary")
| chart avg(duration) by group
- Splunk Rex Expression
- How to determine the length of an array field in Splunk?
- Splunk sub search join returning null values
- Splunk query to find those final results that has events with unique combination of values of two keys in results of main search criteria
- login-info.cfg Splunk file semantic and structure
- Splunk SignalFX Synthetics: Is it possible to retrieve environment variable values in Javascript
- query splunk query joining 2 data tables
- Form a results table view from splunk multiple logs
- Exclude unnecessary logs being sent to splunk cloud platform
- How to Attach Splunk Search Results In JIra Via Terraform Automation?
- Regex Substitue only on a specific group - sedcmd (Splunk)
- Regex to only return matches when followed by a specific word
- embeding conf files into helm chart
- Splunk Logs for Faster Queries, with Category Boolean true
- How to create a timechart in splunk for the timestamp and extracted field?
- Match regex named group up until optional word
- How can I access the TraceId generated by splunk-otel-collector within an ASP.NET web application?
- Splunk result in Table format
- Splunk: How to compute the difference of timestamps by id?
- SPLUNK: How can I count events by location with a list of SERVERNAME's?
- How to represent difference between same fields from two different and simultaneous searches in a table format in Splunk?
- Java 11 HttpClient - POST issue
- Flume sink to Splunk?
- Questions related to splunk builtin macros in correlation search
- how to send the local file using splunk forwarder docker image?
- A table of counts of http status by URL
- How do I use a specific date/time in Splunk dashboard with earliest and latest?
- Splunk - Handling a blank token for a dashboard search
- Splunk - Extracting from search results using regex and aggregates
- Splunk - Grouping by distinct field with stats of another field