timechart command: Examples
The following are examples for using the SPL2 timechart command.
1. Chart the count for each host in 1 hour increments
For each hour, calculate the count for each host value.
...| timechart span=1h count() by host2. Chart the average of "CPU" for each "host"
For each minute, calculate the average value of "CPU" for each "host".
... | timechart span=1m avg(CPU) BY host3. Chart the product of two averages for each host
For each minute, calculate the product of the average "CPU" and average "MEM" and group the results by each host value. This example uses an <eval-expression> with the avg stats function, instead of a <field>.
... | timechart span=1m eval(avg(CPU) * avg(MEM)) BY host4. Chart the average of cpu_seconds by processor
Create a timechart of the average of cpu_seconds by processor, rounded to 2 decimal places.
... | timechart eval(round(avg(cpu_seconds),2)) BY processor5. Chart the average "thruput" of hosts over time
Create a timechart of the average of the thruput field and group the results by each host value.
... | timechart span=5m avg(thruput) BY host6. Align the chart time bins to local time
Align the time bins to 5am (local time). Set the span to 12h. The bins will represent 5am - 5pm, then 5pm - 5am (the next day), and so on.
...| timechart _time span=12h aligntime=@d+5h