Search code examples
splunksplunk-querysplunk-dashboard

Splunk - Group X-axis elements together

I have this chart in a Splunk dashboard

The x-axis refers to the different hosts executing our BAU Process. The y-axis refers to the time taken for the BAU Process to finish

enter image description here

The code to generate the chart is

(host = "A" OR host = "B" OR host = "C" OR host = "D" OR host = "E" OR host = "F" OR host = "G" OR host = "H") 
AND source = "logs/BAU.log"

| transaction submission_id startswith="ABC Logic begins" endswith="ABC Logic ended"

| chart avg(duration) by host

I would like to group the hosts into 2 main groups: "Primary" & "Secondary"

Hosts "A", "B", "C", "D" should be in "Primary"

Hosts "E", "F", "G", "H" should be in "Secondary"

So the chart should be:

  • Y-axis - average execution time of the group
  • X-axis - group

Would anyone be able to assist me with this? I've tried Googling but I can't quite seem to hit the correct results, thanks

Solution

  • You want to chart by group instead of host.

    You can use eval command with an if function to create a field with a value that is either Primary or Secondary by testing whether the host value is in the list of Primary values using an if condition, then plot by group:

    (host = "A" OR host = "B" OR host = "C" OR host = "D" OR host = "E" OR host = "F" OR host = "G" OR host = "H") AND source = "logs/BAU.log"
| transaction submission_id startswith="ABC Logic begins" endswith="ABC Logic ended"
| eval group = if (host in ("A", "B", "C", "D"), "Primary",  "Secondary")
| chart avg(duration) by group