Reply
Highlighted
Accepted Solution

Compare to previous time frame (last hour, Yesterday, last week)

Expert
Posts: 180
6755     0

With our IBGraph tool we have several graphs setup where a specific members or groups of members current stats (query count, CPU, ect) are displayed on a graph at the same time some previous times stats.   This is a very fast way to visualize what is "normal".

Splunk can do this but there is some significat time math involved.   However, it appears that there are several plug-ins that are available to make this work much easier.   Is there anything hidden in Infoblox's splunk code to do this work?  It doesn't look like there is any way to load extra tools in splunk.

Here is the type of graph I'm looking to create:

CPU

Re: Compare to previous time frame (last hour, Yesterday, last week)

Adviser
Posts: 97
6756     0

I actually haven't seen the IBGraph output before. Thanks for sharing that. Turns out, it's pretty trivial to do this with Splunk. I was able to do it with some help from this blog post

 

screencapture-demogm1-infoblox-com-ui-si5GcAPjP-k8Xh0oePm_Yw-si5fe-wsi8c-1463006217422.png

 

Here is the SPL that generated that output.

 

index=ib_system_summary report=si_cpu_usage            (orig_host="demogm1.infoblox.com")  earliest=-1w@w | bin span=1h _time | addinfo | eval marker = if(_time < info_min_time + 7*24*3600, "Last Week", "Current Week") | eval _time = if(_time < info_min_time + 7*24*3600, _time + 7*24*3600, _time) | chart avg(CPU_PERCENT) by _time marker

Re: Compare to previous time frame (last hour, Yesterday, last week)

Adviser
Posts: 97
6756     0

I actually haven't seen the IBGraph output before. Thanks for sharing that. Turns out, it's pretty trivial to do this with Splunk. I was able to do it with some help from this blog post

 

screencapture-demogm1-infoblox-com-ui-si5GcAPjP-k8Xh0oePm_Yw-si5fe-wsi8c-1463006217422.png

 

Here is the SPL that generated that output. You will need to adjust the "orig_host" part of the search for your grid member name.

 

 

index=ib_system_summary report=si_cpu_usage            (orig_host="demogm1.infoblox.com")  earliest=-1w@w | bin span=1h _time | addinfo | eval marker = if(_time < info_min_time + 7*24*3600, "Last Week", "Current Week") | eval _time = if(_time < info_min_time + 7*24*3600, _time + 7*24*3600, _time) | chart avg(CPU_PERCENT) by _time marker

 

Re: Compare to previous time frame (last hour, Yesterday, last week)

Expert
Posts: 180
6756     0

That is much easier than the how to guide \ code I found.  I'll take a look and see how that works in my reports.

Re: Compare to previous time frame (last hour, Yesterday, last week)

Expert
Posts: 180
6756     0

I have this setup now on a few different reports and it works well.   If you want the output to look exactly like the first window where there is a line and an area graph, the setting you are looking for is the data overlay field.

 <option name="charting.chart.overlayFields">"Current Week"</option>

Showing results for 
Search instead for 
Do you mean 

Recommended for You