XQL for Creating Multi-Series Line Timechart Graph

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

XQL for Creating Multi-Series Line Timechart Graph

L1 Bithead

Hi all.

I want to create multi-line graph, and I can create it. But My XQL query is too long and too many manual operation is there.
Do you have good idea for create multi-series line graph? (more shorter one)

Example (Just example. There are no Confidential Information)
When I have some datesets, and I want to create graph for Log Ingestion count for each dataset.
To count log numbers, I use _product field for distinguish each dataset.

Field value example is here "

httpd
parse
parsetime
httpdv2
apache
httpd_droptest
regexcapture

To create multi-series time-series graph, I wrote query below.

dataset = vendor_*
| alter regexcapture = if (_product="regexcapture", 1,0)
| alter httpd_droptest = if (_product="httpd_droptest", 1,0)
| alter httpd = if(_product="httpd",1,0)
| alter parse = if(_product="parse",1,0)
| alter parsetime = if(_product="parsetime",1,0)
| alter httpdv2 = if(_product="httpdv2",1,0)
| alter apache = if(_product="apache",1,0)
| bin _time span = 1h
| comp sum(regexcapture) as regexcapture , sum(httpd_droptest) as httpd_droptest , sum(httpd) as httpd, sum(parse) as parse, sum(parsetime) as parsetime, sum(httpdv2) as httpdv2, sum(apache) as apache, count() as all by _time | view graph type = line xaxis = _time yaxis = httpd_droptest , regexcapture, httpd, parse, parsetime, httpdv2, apache

Then, I get graph below

HFukuda_0-1725501004747.png


I can create multi-series timechart graph, but this query has some problem.

Problem 1. Too Long.

This is very simple graph, but I need very long command. If we can this query become shorter, please advice for me.

Problem 2. Very inconvenient.
To count each dataset, I have to create new field name using alter command and I have to check _product field.
And I have to use sum function for each dataset, and I have to set Y-Axis field name using view command.
If I got new dataset name, I have to change each point.

Very very inconvenient... 

Does there any useful command like a timechart or foreach or eval function(XQL have alter command but there are no alter function) on SPL?

2 REPLIES 2

L4 Transporter

Hi @H.Fukuda, thanks for reaching us using the Live Community.

 

There is an out of the box dashboard called "Data Ingestion" with a few graphs and some other useful information similiar to your needs. Have you taken a look on that one?

 

JM

Hi Jmazzeo,


Thanks for repling my post.

>Data Ingestion

My graph's data source is just example.

My question is how to create more easier XQL query.

So I will appreciate if you share good XQL example.

  • 324 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!