Splunk ①

搜索剖析

基础

词汇大小写不敏感

  1. index=main brookings

区分大小写：index=main CASE(Brookings)

关键字大小写敏感

搜索and：index=main brookings and 132km
AND是关键字：index=main brookings AND 132km

字符串括起来

字符串括起来

错误

  1. index=main OR
  2. index=main (
  3. index=main |
  4. index=main []
  5. index=main =

正确

  1. index=main OR
  2. index=main (
  3. index=main |
  4. index=main []
  5. index=main =

字段判断

字段名大小写敏感

能搜到：index=main JSESSIONID=SD6SL7FF7ADFF53113
能搜到（=前后有空格）：index=main JSESSIONID = SD6SL7FF7ADFF53113
搜不到：index=main jsessionid=SD6SL7FF7ADFF53113

字段存在

正确：index=main status=*
错误：index=main status

字段不存在

正确：index=main NOT status=
错误1：index=main NOT status
错误2： index=main status!=

字段值不为空

正确：index=main status=* NOT status=””
错误1：index=main NOT status””
错误2：index=main status NOT status=””

字段值为空

index=main itemId=””

搜索基础

多个关键搜索

A B vs B A

可以搜到：index=main JSESSIONID=SD10SL8FF5ADFF31078 like Gecko
也可以搜到：index=main JSESSIONID=SD10SL8FF5ADFF31078 Gecko like

“A B” vs “B A”

能搜到：index=main JSESSIONID=SD10SL8FF5ADFF31078 “like Gecko”
能搜到： index=main JSESSIONID=SD10SL8FF5ADFF31078 (Gecko like)
搜不到：index=main JSESSIONID=SD10SL8FF5ADFF31078 “Gecko like”

A B vs A OR B

能搜到：index=main JSESSIONID=SD10SL8FF5ADFF31078 739 OR 525
搜不到：index=main JSESSIONID=SD10SL8FF5ADFF31078 739 525

通配符匹配

匹配0到多个字符

index=main source=”tutorialdata.zipwww1/access.log” 648
前中后，且支持多个:
index=main source=”tutorialdata.zip:./www1/access.log” Appkt
匹配特殊字符
当匹配开头结尾是特殊字符时，不如预期
能搜到：
index=main source=”tutorialdata.zipwww1/access.log” productId=S01
index=main source=”tutorialdata.zipwww1/access.log” productId=S1
搜不到：
index=main source=”tutorialdata.zipwww1/access.log” productId=SF1
index=main source=”tutorialdata.zipwww1/access.log” productId=SG01

表达式评估

index=main source=”tutorialdata.zipwww1/access.log” 739 OR 525 1931 OR 704
等价于
index=main source=”tutorialdata.zipwww1/access.log” (739 OR 525) (1931 OR 704)
index=main AND source=”tutorialdata.zip*www1/access.log” AND (739 OR 525) AND (1931 OR 704)

字段类型

范围：index=main status>200 status<500
数值与文本比较：index=main status > 500

【反直觉】NOT vs !=

!=必须存在

字段status必须存在：index=main status!=200

NOT必须存在

字段status可以不存在：index=main NOT status=200

特例（判断字段存在）

正确：index=main NOT status=
错误（永远无匹配）： index=main status!=

Search vs. Where

搜索2个字段值相同

错误：index=main source=”tutorialdata.zipwww1/access.log” status=bytes`
正确：index=main source=”tutorialdata.zipwww1/access.log” | where status=bytes

宽(-)字符匹配特殊字符

错误：index=main source=”tutorialdata.zipwww1/access.log” productId=SF1
正确：index=main source=”tutorialdata.zipwww1/access.log” | where like(productId, “SF%1”)
表达式计算：
status是100倍数的：
错误：index=main status%100=0
正确：index=main status= | where status%100=0
评估顺序：
index=main status= | where isnum(status) and status>=500 or status=404
等价于
index=main status= | where (isnum(status) and status>=500) or status=404

排序

最近发生的前10条错误日志

index=main source=”tutorialdata.zip*www1/access.log” | sort 10 -status
sort 0 取消限制 。 字段前面加-号： 降序。 默认为+号：升序。

最早发生的前10条错误日志

index=main source=”tutorialdata.zip*www1/access.log” | sort 10 -status _time
_time:是一个字段。

字段类型排序

文本优先：index=main | sort 10 -status
数字优先：index=main | sort 10 -num(status)

分词

分词符

可以搜索到：
index=main JSESSIONID=SD10SL8FF5ADFF31078 KHTML, Like
顺序不重要：
index=main JSESSIONID=SD10SL8FF5ADFF31078 Like, KHTML
分词符可以省略：
index=main JSESSIONID=SD10SL8FF5ADFF31078 KHTML Like
分词符还是需要匹配：
index=main JSESSIONID=SD10SL8FF5ADFF31078 KHTML& Like

双引号

精准匹配
可以搜出：index=main JSESSIONID=SD10SL8FF5ADFF31078 “KHTML Like”
搜不出来：index=main JSESSIONID=SD10SL8FF5ADFF31078 “KHTML Like””

主副分词符

主分词符不讲究顺序

index=main JSESSIONID=SD10SL8FF5ADFF31078 like Gecko
index=main JSESSIONID=SD10SL8FF5ADFF31078 Gecko like

副分词符，都可以搜出来

index=main JSESSIONID=SD10SL8FF5ADFF31078 Safari/536.5
index=main JSESSIONID=SD10SL8FF5ADFF31078 Safari/536
index=main JSESSIONID=SD10SL8FF5ADFF31078 Safari
index=main JSESSIONID=SD10SL8FF5ADFF31078 536.5 Safari
搜不出来；index=main JSESSIONID=SD10SL8FF5ADFF31078 Safari/53
搜不出来；index=main JSESSIONID=SD10SL8FF5ADFF31078 536.5/Safari

精准副词搜索

可以搜出来：index=main JSESSIONID=SD10SL8FF5ADFF31078 TERM(Safari/536.5)
搜不出来：index=main JSESSIONID=SD10SL8FF5ADFF31078 TERM(Safari/536)

搜索时间

绝对时间（左闭右开）

某一秒（03/28/2020:18:20:54）发生的事件

错误：index=main source=”tutorialdata.zipwww1/access.log” earliest=”03/28/2020:18:20:54” latest=”03/28/2020:18:20:54”
正确：index=main source=”tutorialdata.zipwww1/access.log” earliest=”03/28/2020:18:20:54” latest=”03/28/2020:18:20:55”

相对时间

1小时内的日志：index=_internal earliest=-1h

相对时间对齐

三周前的工作日的事件

w0表示周日（蛤？）
index=main source=”tutorialdata.zipwww1/access.log” earliest=-3w@w1 latest=-2w@w6
index=main source=”tutorialdata.zipwww1/access.log” action=purchase (earliest=-21d@d+7h latest=-21d@d+10h) OR (earliest=-21d@d+16h latest=-21d@d+19h) | stats count

上一个小时的日志

index=_internal earliest=-1h@ latest=@h

昨天的日志总数

index=_internal earliest=-1d@ latest=@d

评估函数

计算新字段

传输的KB大小

index=main source=”tutorialdata.zip*www1/access.log” | eval bytes_kb = round(bytes/1000,2)

与统计字段结合使用

统计状态是404错误的日志类型

index=main | stats count(eval(status=”404”)) as count_status by sourcetype

字段值拼接

正确：index=main source=”tutorialdata.zipwww1/access.log” | eval action_dsc=action.productId
不推荐（数字时与预期不一样）：index=main source=”tutorialdata.zipwww1/access.log” | eval action_dsc=action+productId

依赖

index=main source=”tutorialdata.zip*www1/access.log” | eval bytes_kb = round(bytes/1024, 2), bytes_kb_desc = bytes_kb.” KB”

复杂组合计算

domain地址拆分：index=main source=”tutorialdata.zipwww1/access.log” | eval addr=split(referer_domain,”.”), domain=mvindex(addr,-1), location=if(match(domain, “[^\n\r\s]+.(com|net|org)”), “local”, “abroad”) | stats count BY location
index=main source=”tutorialdata.zipwww1/access.log” | eval product_ser = split(productId, “-“), prd_c1=mvindex(product_ser, 0), prd_c2= mvindex(product_ser, 1), prd_c3=mvindex(product_ser, 2) | fields - product_ser

Splunk②

子查询

访问最多的客户端的事件

  1. index=main source=*access* [search index=main source=*access* | top 1 clientip showcount=false showperc=false]

错误访问最多的5个uri的访问趋势

  1. index=main source=*access* [search index=main source=*access* status >= 400 | top 5 uri_path showcount=false showperc=false] | timechart span=1d count

全文匹配

包含访问最多文件名文本的所有事件

  1. index=main source=*access* [search index=main source=*access* status >= 400 | top 1 file showcount=false showperc=false | rename file as search ]

嵌套

找出出错最多的客户端IP或URL，获得他们的所有事件

  1. index=main source=*access* [search index=main source=*access* | top 1 clientip showcount=false showperc=false ] OR [search index=main source=*access* status >= 400 | top 1 uri_query showcount=false showperc=false]

Top20产品的前5个买手的购买时间规律

  1. index=main source="tutorialdata.zip*www1/access.log" [search index=main source="tutorialdata.zip*www1/access.log" action=purchase [search index=main source="tutorialdata.zip*www1/access.log" action=purchase | top 20 productId showcount=false showperc=false] | top 5 clientip showcount=false showperc=false] | stats count by date_hour | sort num(date_hour)

买的最多的买家，他去对卖的最多的产品的访问日志

  1. index=main source=access [search index=main source=access action=purchase | top 1 productId showcount=false showperc=false] [search index=main source=access action=purchase | top 1 clientip showcount=false showperc=false]

买的最多的买家的访问日志（但是排除掉 卖的最多的这个产品）

  1. index=main source=access NOT [search index=main source=access action=purchase | top 1 productId showcount=false showperc=false] [search index=main source=access action=purchase | top 1 clientip showcount=false showperc=false]

统计表格

stats

一维多列

统计PV、UV
  1. source="access" | stats count as pv, distinct_count(clientip) as uv

二维多列

统计各个网站Refere站点的GET/Post数量
  1. source="access" | stats count(eval(method="GET")) AS GET, count(eval(method="POST")) AS POST BY referer_domain

带图

购买统计与趋势

  1. source="access" | stats count, sparkline(count) as sparkline by action | sort -count
  3. index=main source="access" | stats count, sparkline(count, 1h) as sparkline by action | sort -count

timechart

统计每日UV访问趋势

  1. index=main source=access| timechart dc(clientip) AS unique_visitors
  3. index=main source="access" | timechart span=1d count as pv, dc(clientip) as uv

统计3周前的第一个工作日的PV和UV访问趋势

  1. index=main source="tutorialdata.zip*www1/access.log" | timechart span=1h dc(clientip) AS uv, count as pv

// earliest=-3w@w1 latest=-3w@w2

Top, rare

购买最多的客户端

  1. index=main source="*access*" action=purchase | top 1 clientip showcount=false showperc=false

购买最少的商品

  1. index=main source="*access*" action=purchase | rare 1 productId

Event/StreamStat

购买Top10的商品，每一行加上前10的总数

  1. source=access action=purchase | top productId | eventstats sum(count) as totalcount

给每一行加上编号

  1. source=*access* action=purchase | top productId | eventstats sum(count) as totalcount | streamstats count as "#" | fields "#", productId, *

404错误累计错误数量

  1. source=*access* action=purchase | top productId | eventstats sum(count) as totalcount | streamstats count as "#" | fields "#", productId, *

用stats实现top

  1. index=main source="*access*" productId=* | stats count by productId | eventstats sum(count) as totalcount | eval percent = round(count/totalcount*100 , 2)."%" | fields - totalcount | sort -count | head 5
  1. index=main source="access" productId= | join [search index=main source="access" productId= | top 5 productId showcount=false showperc=false | stats values(productId) as top5 ] | eval productId=if(like(top5, "%".productId."%"), productId, "OTHERS") | stats count by productId | eventstats sum(count) as totalcount | eval percent = round(count/totalcount*100 , 2)."%" | fields - totalcount | sort -count | head 5

基础补充

命令调用

bool参数

  1. index=main source=access | top clientip showperc=f

参数分隔符

  1. index=main source=access | top clientip method

Eval函数

不存在的值

null值会被忽略：

  1. index=main source=*access* | eval k1=null()

同理：

  1. index=main source=access | eval k1=typeof(coalesce(xxx, yyy))

去除字段：

  1. index=main | eval status=if(isnum(status), status, null())

Bool值不能赋值

错误：index=main source=access | eval result=like(productId, “WC%”)
正确1：index=main source=access | eval result=if(like(productId, “WC%”), “Yes”, “No”)
正确2: index=main source=access | eval result=tostring(isnull(productId))

类型判断

判断数字

  1. | makeresults 1 | eval k1=100, k2="100", k3=-100, result=tostring(isint(k1)).tostring(isint(k2)).tostring(isint(k3))

注意：字段本质没有类型，都是字符串，用isint后尝试类型转换后判断。

判断字符

  1. | makeresults 1 | eval k1=100, k2="100", result=tostring(isstr(k1)).tostring(isstr(k2))

布尔值判断
  1. | makeresults 1 | eval k1=100, k2="100", result=tostring(isstr(k1)).tostring(isstr(k2))

字段判断

字段是否存在

错误1： index=main source=access | eval result=isnull(field1)
错误2：index=main | eval result=if(status==null(), “not exist”, “exist”)
错误3：| makeresults 1 | eval f1=100, f2=”xxx”, f3=”” | eval result=if(f1==”“, “not null.”, “null”)
正确1：| makeresults 1 | eval f1=100, f2=”xxx”, f3=”” | eval result=if(isnull(f1), “null.”, “not null.”).if(isnull(f2), “null.”, “not null.”).if(isnull(f3), “null.”, “not null.”).if(isnull(f4), “null.”, “not null.”)
正确2：| makeresults 1 | eval f1=100, f2=”xxx”, f3=”” | eval result=if(not isnull(f1), “meet.”, “not meet.”).if(not isnull(f2), “meet.”, “not meet.”).if(not isnull(f3), “meet.”, “not meet.”).if(not isnull(f4), “meet.”, “not meet.”)
正确3： | makeresults 1 | eval f1=100, f2=”xxx”, f3=”” | eval result=if(searchmatch(“f1=“), “meet.”, “not meet.”).if(searchmatch(“f2=“), “meet.”, “not meet.”).if(searchmatch(“f3=“), “meet.”, “not meet.”).if(searchmatch(“f4=“), “meet.”, “not meet.”)
正确4：| makeresults 1 | eval result=coalesce(status, “default”)
*相对于有isnotnull。

字段存在且为空

正确1：| makeresults 1 | eval f1=100, f2=”xxx”, f3=”” | eval result=if(f1==””, “meet.”, “not meet.”).if(f2==””, “meet.”, “not meet.”).if(f3==””, “meet.”, “not meet.”).if(f4==””, “meet.”, “not meet.”)
其中：==可以换成=
正确2：| makeresults 1 | eval f1=100, f2=”xxx”, f3=”” | eval result=if(searchmatch(“f1=”””), “meet.”, “not meet.”).if(searchmatch(“f2=”””), “meet.”, “not meet.”).if(searchmatch(“f3=”””), “meet.”, “not meet.”).if(searchmatch(“f4=”””), “meet.”, “not meet.”)
错误：| makeresults 1 | eval f1=100, f2=”xxx”, f3=”” | eval result=if(searchmatch(“f3==”””), “meet.”, “not meet.”)
注意：不能使用==

字段存在且不为空

正确1：| makeresults 1 | eval f1=100, f2=”xxx”, f3=”” | eval result=if(f1!=””, “meet.”, “not meet.”).if(f2!=””, “meet.”, “not meet.”).if(f3!=””, “meet.”, “not meet.”).if(f4!=””, “meet.”, “not meet.”)
正确2：| makeresults 1 | eval f1=100, f2=”xxx”, f3=”” | eval result=if(not f1==””, “meet.”, “not meet.”).if(not f2==””, “meet.”, “not meet.”).if(not f3==””, “meet.”, “not meet.”).if(not f4==””, “meet.”, “not meet.”)
正确3：| makeresults 1 | eval f1=100, f2=”xxx”, f3=”” | eval result1=nullif(f1, “”), result2=nullif(f2, “”), result3=nullif(f3, “”), result4=nullif(f4, “”)
nullif：用于忽略特定值返回原值

返回第一个存在值得字段

coalesce选择第一个存在的字段(哪怕值为空)，不存在返回null()：

  1. | makeresults 1 | eval k1=100, k2="100", result=tostring(isstr(k1)).tostring(isstr(k2))

返回第一个存在且值不为空字段

  1. | makeresults 1 | eval k1=100, k2="100", result=tostring(isstr(k1)).tostring(isstr(k2))

不存在的字段，比较时，默认都不满足条件

  1. index=main | eval f1=100, f2="xxx", f3="" | eval result=if(f4=="", "meet.", "not meet.").if(f4!="", "meet.", "not meet.")

case/validate

字段简单富化

  1. index=main | eval status_desc=case(isnull(status), "Unknown: Empty", not isnum(status), "Unknown: invalid value: ".status, status>=500, "Internal Error", stauts >= 400, "Authentication Error", status >= 300, "Redirect Error", status >= 200, "Success", true(), "Unknown: out of range: ".status)

注意：一般使用true()做默认值。

validate的行为与case相反，第一个False的先返回

字符串匹配

最基本匹配:=， ==, !=

  1. index=main | eval result=status.": ".if(status=400, "**AUTH**", "other")

多个值匹配: in

  1. index=main | eval f1="error" | eval result=if(in(f1, "failed", "invalid", "unkonwn", "error"), "failed", "success")

模式匹配: like

  1. index=main | eval result=status.": ".if(like(status, "4%"), "AUTH", "other")

注意: _表示单个字符

正则匹配： match

  1. index=main | eval result=status.": ".if(like(status, "4%"), "AUTH", "other")

时间格式化

时间对齐

  1. index=main source=*access* | eval result=strftime(relative_time(_time, "+1d"), "%Y-%m- %dT%H:%M:%S.%Q")

高级搜索

正则表达式

regex过滤

局部匹配
  1. index=main source="*access*" | regex productId="S.+G01"

完整匹配
  1. index=main source="access" | regex productId="^S.+G01$"

replace操作
  1. index=main source=*access* productId=* | eval productId_new = replace(productId, "(\w+)-(\w+)-(\w+)", "\2-\3-\1") | table productId, productId_new

Rex提取

命名匹提取
  1. index=main source="access" | rex field=productId "(?\w+)-(?\w+)-(?\w+)"

多值提取
  1. | makeresults 1 | eval k1="123 456 789" | rex field=k1 "(?\d+)" max_match=0

常见案例
  1. <test>123</test> <test>456</test>
  3. <test>.+</test>
  4. | makeresults 1 
  5. |  eval s = "xxx yyy@yahoo.com" 
  6. | rex field=s "(?P<user>\w+)@(?P<company>\w+)\.com"
  7. index=main source=*access* productId=*
  8. |  rex field=productId "(?P<type1>\w+)-(?P<type2>\w+)-(?P<type3>\w+)" 
  9. | rex field=_raw "HTTPS?\s+(?P<http_version>\d+\.\d+)"
  10. wangxiao@163.com
  11.   wanglao@163.com
  12.   163@163.com
  13.   qq@qq.com
  14.   yahoo@yahoo.com
  16.   (\w+)@\1.com
  17. | makeresults 1 
  18. |  eval s = "xxx yyy@yahoo.com.cn" 
  19. | rex field=s "(?P<user>\w+)@(?P<company>\w+\.(?:com|cn)(?:\.cn)?)"
  20. | makeresults 1 
  21. |  eval s = "xxx yyy@yahoo.COM.cn" 
  22. | rex field=s "(?i)(?P<user>\w+)@(?P<company>\w+\.(?:com|cn)(?:\.cn)?)"

KV键值对

  1. | makeresults 1 | eval _raw="k1=v1 k2=v2 k3=v3" | extract kvdelim=" " pairdelim="="

XML操作

简单KV提取操作
  1. | makeresults 1 | eval _raw="<student1>xiaoming</student1><student2>xiao wang</student2>" | xmlkv maxinputs=10000

XPATH提取

提取属性
  1. | makeresults 1 | eval val=" <bar nickname="spock"><bar nickname="scotty"><bar nickname="bones">" | xpath field=val outfield=name "//bar/@nickname"

提取值
  1. | makeresults 1 | eval val" <bar nickname="spock">abc<bar nickname="scotty">xyz<bar nickname="bones">zzz" | xpath field=val outfield=name "//bar"
  1. | makeresults 1 | eval val="<b name="xxxx">123" | xpath field=val outfield=name "//b/@name"

选择特定item提取
  1. | makeresults 1 | eval val=" <bar nickname="spock">abc<bar nickname="scotty">xyz<bar nickname="bones">zzz" | xpath field=val outfield=name "//bar[@nickname='spock']"

spath提取

  1. | makeresults 1 | eval val=" <bar nickname="spock">abc<bar nickname="scotty">xyz<bar nickname="bones">zzz" | spath input=val output=name path=foo.bar
  1. | makeresults 1 | eval val="123456" | spath input=val output=name "a.b"

JSON 提取

按路径提取属性
  1. | makeresults 1 | eval val="{"name": "xiaoming", "books": ["c++", "splunk"], "address": {"city": "shanghai", "distinct": "pudong"} }" | spath input=val output=name path=address.city | table name

数组提取
  1. | makeresults 1 | eval val="{"name": "xiaoming", "books": ["c++", "splunk"], "address": {"city": "shanghai", "distinct": "pudong"} }" | spath input=val output=book path=books{} | table book
  1. | makeresults 1 | eval val="{"age": [10, 28] }" | spath input=val output=age "age{}"
  1. | makeresults 1 | eval val="{"age": [{"home":"nanjing"}, {"home": "shanghai"}] }" | spath input=val output=age "age{}.home"

数组路径深度提取
  1. | makeresults 1 | eval val="{"name": "xiaoming", "books": ["c++", "splunk"], "address": {"city": "shanghai", "distinct": "pudong"}, "family": [{"name": "xiao xiao ming"}, {"name": "kelly"} ] }" | spath input=val output=family path=family{}.name | table family

多值提取与实践分裂
  1. | makeresults 1 | eval val="[{"age":3,"name":"xiao ming"},{"age":28,"name":"kelly"}]" | spath input=val output=name path={}.name | spath input=val output=age path={}.age | eval combine=mvzip(name, age) | table combine | mvexpand combine | eval ss = split(combine, ","), name=mvindex(ss, 0), age=mvindex(ss, 1) | table name, age
  1. | makeresults 1 | eval val=split("x1,x2,z3", ",") , v2=split("t1,t2,t3", ",") | eval val_3 = mvzip(val, v2) | mvexpand val_3 | makemv delim="," val_3 | fields val_3 | eval v1=mvindex(val_3, 0), v2=mvindex(val_3, 1)

查找异常

高级图表：chart vs timechart vs stats

stats

标准group-by
  1. sourcetype=access_* | stats avg(other) as resp, count by productId, action

X轴: by，支持多个
Y轴（统计值）: f1, f2, ….

支持：多对多，结构静态

支持3+维度X轴
  1. sourcetype=access_* | stats avg(other) as resp, count by productId, action, itemId

默认5,000

chart

单个X，与stats一样
  1. sourcetype=access_* | chart avg(other) as resp, count by productId

多X轴，动态展开Y轴
  1. index=main source=*access* productId=* action=* | chart count, avg(bytes) by action, productId

by X轴，动态展开Y轴*统计函数

支持：一对多，Y轴动态

等价于：

  1. index=main source=access productId= action= | chart count, avg(bytes) over action by productId

over X轴 by 动态展开Y轴*统计函数
合法：

  1. sourcetype=access_* | chart eval(sum(bytes)/1024) as s1

错误：

  1. sourcetype=access_* | stats eval(sum(bytes)/1024) as s1

timechart

  1. index=main source=access productId= action= | timechart span=1d count, avg(bytes) by action

自动X轴（Span）时间
by 动态Y轴*统计函数

支持：一对多，X时间，Y轴动态

默认span设定
  1. | Time range | Default span | | :-------------- | :----------- | | Last 15 minutes | 10 seconds | | Last 60 minutes | 1 minute | | Last 4 hours | 5 minutes | | Last 24 hours | 30 minutes | | Last 7 days | 1 day | | Last 30 days | 1 day | | Previous year | 1 month |
  1. index=main source=access productId= action= earliest="03/22/2020:00:00:00" latest="03/23/2020:00:00:00" | timechart count by action

统计函数

计算UV

distinct_count vs estdc
  1. index=main | stats dc(clientip) as f1, estdc(clientip) as f3

计算分位
  1. sourcetype=access_* | stats min(other), max(other), perc0(other), perc99(other), perc95(other) by action.upperperc（不知道能不能这样）

image.png

list vs values
  1. sourcetype=access_* | head 10 | stats list(action), values(action)

Eval
  1. index=main source=access | stats count(eval(isnotnull(productId) and status=400)) as value, count as total

Join

Union

合并实践，使用Append合并实践
  1. | makeresults 1 | eval s1 = "test1" | append [ makeresults 1 | eval s1="test2"]

合并多个
  1. | makeresults 1 | eval s1 = "test1" | union [ makeresults 1 | eval s1="test2"] [ makeresults 1 | eval s1="test3"]

类型

Left/Right/Self Join

使用join构建top+others
  1. index=main source=access | join type=left clientip [search index=main source=access | top 10 clientip showperc=f | streamstats count as rank ] | eval clientip=if(rank>=1, clientip, "others"), rank=coalesce(rank, 11) | stats count by clientip, rank | sort by rank | table clientip, count

lookup

查看lookup
  1. | inputlookup geo_attr_countries

使用lookup
  1. index=main source=access | top clientip showperc=f | iplocation clientip | table clientip, count, City, Country | lookup geo_attr_countries country as Country OUTPUT iso2
  1. index=main source=access | top clientip showperc=f | iplocation clientip | table clientip, count, Country | lookup geo_attr_countries country as Country OUTPUT continent

构建lookup
  1. index=main source=access | top 10 clientip showperc=f | outputlookup top10clientip.csv

使用
  1. index=main source=access | top 11 clientip showperc=f showcount=f | lookup top10clientip clientip OUTPUT count

事务

一般性事务
  1. sourcetype=access_* | transaction JSESSIONID clientip startswith="view" endswith="purchase" | where duration>0

额外属性 duration，eventcount
maxevents: 默认最大1000条内容汇集。

卖的最快的Top10 产品
  1. sourcetype=access_* | transaction JSESSIONID clientip startswith="view" endswith="purchase" | stats avg(duration) as du, count by productId | sort du

高级事务

最慢恢复的访问记录
  1. sourcetype=access_* | transaction JSESSIONID clientip startswith=status>=400 endswith=status<400| search duration>5

数据集处理

untable
  1. sourcetype=access_* | stats count, min(bytes), max(bytes) by action

X-Y1-Y2-Y3

改成三元组
  1. sourcetype=access_* | stats count, min(bytes), max(bytes) by action | untable action, type, value

xyseries

三元组Pivot化
  1. sourcetype=access_* | stats count, min(bytes), max(bytes) by action | untable action, type, value | xyseries action type value

stats vs chart
  1. sourcetype=access_* | stats count by action, status | xyseries action status count

等价于
  1. sourcetype=access_* | chart count by action, status

补齐
  1. sourcetype=access_* | head 10 | fillnull value="Unknown" productId, itemId, xxx

可视化案例

单值图

  1. index=_internal source="*splunkd.log" log_level="info" | timechart count

地图

  1. index=main source=access | stats count by clientip | sort-count | head 10 | iplocation clientip | geostats count by Country latfield=lat longfield=lon

面积图

  1. index= sourcetype=access* latest=03/28/2020:23:59:59 | timechart count(eval(method="GET")) AS GET,count(eval(method="POST")) AS POST

预测图

  1. index=internal sourcetype="*access*" | timechart count(bytes) as traffic | streamstats sum(traffic) as total_traffic | predict total_traffic as expected_traffic algorithm=LLT future_timespan=14 | fields time, total_traffic, expected_traffic

今日昨日对比图

  1. index=main source=access earliest="03/25/2020:00:00:00" latest="03/26/2020:00:00:00" | timechart span=1h count as pv | streamstats count as num | join [search index=main source=access earliest="03/24/2020:00:00:00" latest="03/25/2020:00:00:00" | timechart span=1h count as pv_yesterday | streamstats count as num ] | fields - num

SparklLine

  1. index=main sourcetype="access" | chart count sparkline(count, 1h) by status

Token

  1. index=training source=access action=$action_token$ | timechart span=1d count

完整的图表XML

  1. <dashboard theme="light">
  2.   <label>仪表盘汇总</label>
  3.   <row>
  4.     <panel>
  5.       <title>单值图</title>
  6.       <single>
  7.         <search>
  8.           <query>index=_internal source="*splunkd.log" log_level="info" | timechart count span=1d</query>
  9.           <earliest>1620187200</earliest>
  10.           <latest>1620576000</latest>
  11.           <sampleRatio>1</sampleRatio>
  12.         </search>
  13.         <option name="colorBy">trend</option>
  14.         <option name="colorMode">none</option>
  15.         <option name="drilldown">none</option>
  16.         <option name="numberPrecision">0</option>
  17.         <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
  18.         <option name="rangeValues">[0,30,70,100]</option>
  19.         <option name="refresh.display">progressbar</option>
  20.         <option name="showSparkline">1</option>
  21.         <option name="showTrendIndicator">1</option>
  22.         <option name="trellis.enabled">0</option>
  23.         <option name="trellis.scales.shared">1</option>
  24.         <option name="trellis.size">medium</option>
  25.         <option name="trendColorInterpretation">inverse</option>
  26.         <option name="trendDisplayMode">absolute</option>
  27.         <option name="trendInterval">-1h</option>
  28.         <option name="unitPosition">after</option>
  29.         <option name="useColors">1</option>
  30.         <option name="useThousandSeparators">1</option>
  31.       </single>
  32.     </panel>
  33.     <panel>
  34.       <title>简单单值</title>
  35.       <single>
  36.         <search>
  37.           <query>index=_internal source="*splunkd.log" log_level="info" | stats count</query>
  38.           <earliest>@d</earliest>
  39.           <latest>now</latest>
  40.           <sampleRatio>1</sampleRatio>
  41.         </search>
  42.         <option name="colorBy">trend</option>
  43.         <option name="colorMode">block</option>
  44.         <option name="drilldown">none</option>
  45.         <option name="numberPrecision">0</option>
  46.         <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
  47.         <option name="rangeValues">[0,30,70,100]</option>
  48.         <option name="showSparkline">1</option>
  49.         <option name="showTrendIndicator">1</option>
  50.         <option name="trellis.enabled">0</option>
  51.         <option name="trellis.scales.shared">1</option>
  52.         <option name="trellis.size">medium</option>
  53.         <option name="trendColorInterpretation">inverse</option>
  54.         <option name="trendDisplayMode">absolute</option>
  55.         <option name="trendInterval">-1h</option>
  56.         <option name="unitPosition">after</option>
  57.         <option name="useColors">1</option>
  58.         <option name="useThousandSeparators">1</option>
  59.       </single>
  60.     </panel>
  61.     <panel>
  62.       <title>访问PV vs 前2天</title>
  63.       <single>
  64.         <search>
  65.           <query>index=_internal  source="*splunkd_access.log" earliest=-2d@d   | timechart  span=1d count</query>
  66.           <earliest>0</earliest>
  67.           <latest></latest>
  68.           <sampleRatio>1</sampleRatio>
  69.         </search>
  70.         <option name="colorBy">trend</option>
  71.         <option name="colorMode">none</option>
  72.         <option name="drilldown">none</option>
  73.         <option name="numberPrecision">0</option>
  74.         <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
  75.         <option name="rangeValues">[0,30,70,100]</option>
  76.         <option name="refresh.display">progressbar</option>
  77.         <option name="showSparkline">0</option>
  78.         <option name="showTrendIndicator">1</option>
  79.         <option name="trellis.enabled">0</option>
  80.         <option name="trellis.scales.shared">1</option>
  81.         <option name="trellis.size">medium</option>
  82.         <option name="trendColorInterpretation">standard</option>
  83.         <option name="trendDisplayMode">percent</option>
  84.         <option name="trendInterval">-2d</option>
  85.         <option name="unitPosition">after</option>
  86.         <option name="useColors">1</option>
  87.         <option name="useThousandSeparators">0</option>
  88.       </single>
  89.     </panel>
  90.   </row>
  91.   <row>
  92.     <panel>
  93.       <title>地图点</title>
  94.       <map>
  95.         <search>
  96.           <query>index=main source=*access* 
  97. | stats count by clientip 
  98. |  sort-count 
  99. |  head 10 
  100. |  iplocation clientip 
  101. |  geostats count by Country latfield=lat longfield=lon</query>
  102.           <earliest>0</earliest>
  103.           <sampleRatio>1</sampleRatio>
  104.         </search>
  105.         <option name="drilldown">none</option>
  106.         <option name="mapping.choroplethLayer.colorBins">5</option>
  107.         <option name="mapping.choroplethLayer.colorMode">auto</option>
  108.         <option name="mapping.choroplethLayer.maximumColor">0xaf575a</option>
  109.         <option name="mapping.choroplethLayer.minimumColor">0x62b3b2</option>
  110.         <option name="mapping.choroplethLayer.neutralPoint">0</option>
  111.         <option name="mapping.choroplethLayer.shapeOpacity">0.75</option>
  112.         <option name="mapping.choroplethLayer.showBorder">1</option>
  113.         <option name="mapping.data.maxClusters">100</option>
  114.         <option name="mapping.legend.placement">bottomright</option>
  115.         <option name="mapping.map.center">(0,0)</option>
  116.         <option name="mapping.map.panning">1</option>
  117.         <option name="mapping.map.scrollZoom">0</option>
  118.         <option name="mapping.map.zoom">2</option>
  119.         <option name="mapping.markerLayer.markerMaxSize">50</option>
  120.         <option name="mapping.markerLayer.markerMinSize">10</option>
  121.         <option name="mapping.markerLayer.markerOpacity">0.8</option>
  122.         <option name="mapping.showTiles">1</option>
  123.         <option name="mapping.tileLayer.maxZoom">7</option>
  124.         <option name="mapping.tileLayer.minZoom">0</option>
  125.         <option name="mapping.tileLayer.tileOpacity">1</option>
  126.         <option name="mapping.type">marker</option>
  127.         <option name="trellis.enabled">0</option>
  128.         <option name="trellis.scales.shared">1</option>
  129.         <option name="trellis.size">medium</option>
  130.       </map>
  131.     </panel>
  132.     <panel>
  133.       <title>top referer</title>
  134.       <chart>
  135.         <search>
  136.           <query>index="*" sourcetype=*access*
  137. | top referer_domain
  138. | fields referer_domain count</query>
  139.           <earliest>0</earliest>
  140.           <sampleRatio>1</sampleRatio>
  141.         </search>
  142.         <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
  143.         <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
  144.         <option name="charting.axisTitleX.visibility">visible</option>
  145.         <option name="charting.axisTitleY.visibility">visible</option>
  146.         <option name="charting.axisTitleY2.visibility">visible</option>
  147.         <option name="charting.axisX.abbreviation">none</option>
  148.         <option name="charting.axisX.scale">linear</option>
  149.         <option name="charting.axisY.abbreviation">none</option>
  150.         <option name="charting.axisY.scale">linear</option>
  151.         <option name="charting.axisY2.abbreviation">none</option>
  152.         <option name="charting.axisY2.enabled">0</option>
  153.         <option name="charting.axisY2.scale">inherit</option>
  154.         <option name="charting.chart">bar</option>
  155.         <option name="charting.chart.bubbleMaximumSize">50</option>
  156.         <option name="charting.chart.bubbleMinimumSize">10</option>
  157.         <option name="charting.chart.bubbleSizeBy">area</option>
  158.         <option name="charting.chart.nullValueMode">gaps</option>
  159.         <option name="charting.chart.showDataLabels">none</option>
  160.         <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
  161.         <option name="charting.chart.stackMode">default</option>
  162.         <option name="charting.chart.style">shiny</option>
  163.         <option name="charting.drilldown">none</option>
  164.         <option name="charting.layout.splitSeries">0</option>
  165.         <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
  166.         <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
  167.         <option name="charting.legend.mode">standard</option>
  168.         <option name="charting.legend.placement">right</option>
  169.         <option name="charting.lineWidth">2</option>
  170.         <option name="trellis.enabled">0</option>
  171.         <option name="trellis.scales.shared">1</option>
  172.         <option name="trellis.size">medium</option>
  173.       </chart>
  174.     </panel>
  175.   </row>
  176.   <row>
  177.     <panel>
  178.       <title>Get-Post分布</title>
  179.       <chart>
  180.         <search>
  181.           <query>index=* sourcetype=*access* latest=03/28/2020:23:59:59
  182. | timechart count(eval(method="GET")) AS GET,count(eval(method="POST")) AS POST</query>
  183.           <earliest>0</earliest>
  184.           <sampleRatio>1</sampleRatio>
  185.         </search>
  186.         <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
  187.         <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
  188.         <option name="charting.axisTitleX.visibility">visible</option>
  189.         <option name="charting.axisTitleY.visibility">visible</option>
  190.         <option name="charting.axisTitleY2.visibility">visible</option>
  191.         <option name="charting.axisX.abbreviation">none</option>
  192.         <option name="charting.axisX.scale">linear</option>
  193.         <option name="charting.axisY.abbreviation">none</option>
  194.         <option name="charting.axisY.scale">linear</option>
  195.         <option name="charting.axisY2.abbreviation">none</option>
  196.         <option name="charting.axisY2.enabled">0</option>
  197.         <option name="charting.axisY2.scale">inherit</option>
  198.         <option name="charting.chart">area</option>
  199.         <option name="charting.chart.bubbleMaximumSize">50</option>
  200.         <option name="charting.chart.bubbleMinimumSize">10</option>
  201.         <option name="charting.chart.bubbleSizeBy">area</option>
  202.         <option name="charting.chart.nullValueMode">gaps</option>
  203.         <option name="charting.chart.showDataLabels">none</option>
  204.         <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
  205.         <option name="charting.chart.stackMode">default</option>
  206.         <option name="charting.chart.style">shiny</option>
  207.         <option name="charting.drilldown">none</option>
  208.         <option name="charting.layout.splitSeries">0</option>
  209.         <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
  210.         <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
  211.         <option name="charting.legend.mode">standard</option>
  212.         <option name="charting.legend.placement">right</option>
  213.         <option name="charting.lineWidth">2</option>
  214.         <option name="trellis.enabled">0</option>
  215.         <option name="trellis.scales.shared">1</option>
  216.         <option name="trellis.size">medium</option>
  217.       </chart>
  218.     </panel>
  219.     <panel>
  220.       <title>流量累计预测</title>
  221.       <chart>
  222.         <search>
  223.           <query>index=* sourcetype="*access*"
  224. | timechart count(bytes) as traffic
  225. | streamstats sum(traffic) as total_traffic
  226. | predict total_traffic as expected_traffic algorithm=LLT future_timespan=14
  227. | fields _time, total_traffic, expected_traffic</query>
  228.           <latest>1585411200</latest>
  229.           <sampleRatio>1</sampleRatio>
  230.         </search>
  231.         <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
  232.         <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
  233.         <option name="charting.axisTitleX.visibility">visible</option>
  234.         <option name="charting.axisTitleY.visibility">visible</option>
  235.         <option name="charting.axisTitleY2.visibility">visible</option>
  236.         <option name="charting.axisX.abbreviation">none</option>
  237.         <option name="charting.axisX.scale">linear</option>
  238.         <option name="charting.axisY.abbreviation">none</option>
  239.         <option name="charting.axisY.scale">linear</option>
  240.         <option name="charting.axisY2.abbreviation">none</option>
  241.         <option name="charting.axisY2.enabled">0</option>
  242.         <option name="charting.axisY2.scale">inherit</option>
  243.         <option name="charting.chart">column</option>
  244.         <option name="charting.chart.bubbleMaximumSize">50</option>
  245.         <option name="charting.chart.bubbleMinimumSize">10</option>
  246.         <option name="charting.chart.bubbleSizeBy">area</option>
  247.         <option name="charting.chart.nullValueMode">gaps</option>
  248.         <option name="charting.chart.showDataLabels">none</option>
  249.         <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
  250.         <option name="charting.chart.stackMode">default</option>
  251.         <option name="charting.chart.style">shiny</option>
  252.         <option name="charting.drilldown">none</option>
  253.         <option name="charting.layout.splitSeries">0</option>
  254.         <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
  255.         <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
  256.         <option name="charting.legend.mode">standard</option>
  257.         <option name="charting.legend.placement">top</option>
  258.         <option name="charting.lineWidth">2</option>
  259.         <option name="trellis.enabled">0</option>
  260.         <option name="trellis.scales.shared">1</option>
  261.         <option name="trellis.size">medium</option>
  262.       </chart>
  263.     </panel>
  264.   </row>
  265.   <row>
  266.     <panel>
  267.       <title>今日昨日访问趋势对比</title>
  268.       <chart>
  269.         <search>
  270.           <query>index="_internal" source="*splunkd_access.log" earliest="05/09/2021:00:00:00"
  271. |  timechart span=1h count as pv 
  272. |  streamstats count as num
  273. |  join 
  274.     [search index="_internal" source="*splunkd_access.log" earliest="05/08/2021:00:00:00" latest="05/09/2021:00:00:00" |  timechart span=1h count as pv_yesterday |  streamstats count as num
  275.         ] 
  276. |  fields - num</query>
  277.           <latest>1585411200</latest>
  278.           <sampleRatio>1</sampleRatio>
  279.         </search>
  280.         <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
  281.         <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
  282.         <option name="charting.axisTitleX.visibility">visible</option>
  283.         <option name="charting.axisTitleY.visibility">visible</option>
  284.         <option name="charting.axisTitleY2.visibility">visible</option>
  285.         <option name="charting.axisX.abbreviation">none</option>
  286.         <option name="charting.axisX.scale">linear</option>
  287.         <option name="charting.axisY.abbreviation">none</option>
  288.         <option name="charting.axisY.scale">linear</option>
  289.         <option name="charting.axisY2.abbreviation">none</option>
  290.         <option name="charting.axisY2.enabled">0</option>
  291.         <option name="charting.axisY2.scale">inherit</option>
  292.         <option name="charting.chart">line</option>
  293.         <option name="charting.chart.bubbleMaximumSize">50</option>
  294.         <option name="charting.chart.bubbleMinimumSize">10</option>
  295.         <option name="charting.chart.bubbleSizeBy">area</option>
  296.         <option name="charting.chart.nullValueMode">gaps</option>
  297.         <option name="charting.chart.showDataLabels">none</option>
  298.         <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
  299.         <option name="charting.chart.stackMode">default</option>
  300.         <option name="charting.chart.style">shiny</option>
  301.         <option name="charting.drilldown">none</option>
  302.         <option name="charting.layout.splitSeries">0</option>
  303.         <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
  304.         <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
  305.         <option name="charting.legend.mode">standard</option>
  306.         <option name="charting.legend.placement">top</option>
  307.         <option name="charting.lineWidth">2</option>
  308.         <option name="trellis.enabled">0</option>
  309.         <option name="trellis.scales.shared">1</option>
  310.         <option name="trellis.size">medium</option>
  311.       </chart>
  312.     </panel>
  313.     <panel>
  314.       <title>Spark Line</title>
  315.       <table>
  316.         <search>
  317.           <query>index=* sourcetype="*access*"
  318. | stats count(status) as count sparkline(count) by status</query>
  319.           <latest>1585324800</latest>
  320.           <sampleRatio>1</sampleRatio>
  321.         </search>
  322.         <option name="count">20</option>
  323.         <option name="dataOverlayMode">none</option>
  324.         <option name="drilldown">none</option>
  325.         <option name="percentagesRow">false</option>
  326.         <option name="rowNumbers">false</option>
  327.         <option name="totalsRow">false</option>
  328.         <option name="wrap">true</option>
  329.       </table>
  330.     </panel>
  331.   </row>
  332.   <row>
  333.     <panel>
  334.       <title>访问者Top8</title>
  335.       <chart>
  336.         <search>
  337.           <query>index=main source=*access* 
  338. | top 8 clientip useother=true</query>
  339.           <earliest>0</earliest>
  340.           <latest></latest>
  341.           <sampleRatio>1</sampleRatio>
  342.         </search>
  343.         <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
  344.         <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
  345.         <option name="charting.axisTitleX.visibility">visible</option>
  346.         <option name="charting.axisTitleY.visibility">visible</option>
  347.         <option name="charting.axisTitleY2.visibility">visible</option>
  348.         <option name="charting.axisX.abbreviation">none</option>
  349.         <option name="charting.axisX.scale">linear</option>
  350.         <option name="charting.axisY.abbreviation">none</option>
  351.         <option name="charting.axisY.scale">linear</option>
  352.         <option name="charting.axisY2.abbreviation">none</option>
  353.         <option name="charting.axisY2.enabled">0</option>
  354.         <option name="charting.axisY2.scale">inherit</option>
  355.         <option name="charting.chart">pie</option>
  356.         <option name="charting.chart.bubbleMaximumSize">50</option>
  357.         <option name="charting.chart.bubbleMinimumSize">10</option>
  358.         <option name="charting.chart.bubbleSizeBy">area</option>
  359.         <option name="charting.chart.nullValueMode">gaps</option>
  360.         <option name="charting.chart.showDataLabels">none</option>
  361.         <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
  362.         <option name="charting.chart.stackMode">default</option>
  363.         <option name="charting.chart.style">shiny</option>
  364.         <option name="charting.drilldown">none</option>
  365.         <option name="charting.layout.splitSeries">0</option>
  366.         <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
  367.         <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
  368.         <option name="charting.legend.mode">standard</option>
  369.         <option name="charting.legend.placement">right</option>
  370.         <option name="charting.lineWidth">2</option>
  371.         <option name="refresh.display">progressbar</option>
  372.         <option name="trellis.enabled">0</option>
  373.         <option name="trellis.scales.shared">1</option>
  374.         <option name="trellis.size">medium</option>
  375.       </chart>
  376.     </panel>
  377.   </row>
  378.   <row>
  379.     <panel>
  380.       <title>错误访问最多的5个uri的访问趋势</title>
  381.       <chart>
  382.         <search>
  383.           <query>index=main source=*access* 
  384.     [search index=main source=*access* status &gt;= 400
  385.     |  top 5 uri_path showcount=false showperc=false] 
  386. |  timechart span=1d count</query>
  387.           <earliest>0</earliest>
  388.           <latest></latest>
  389.           <sampleRatio>1</sampleRatio>
  390.         </search>
  391.         <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
  392.         <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
  393.         <option name="charting.axisTitleX.visibility">visible</option>
  394.         <option name="charting.axisTitleY.visibility">visible</option>
  395.         <option name="charting.axisTitleY2.visibility">visible</option>
  396.         <option name="charting.axisX.abbreviation">none</option>
  397.         <option name="charting.axisX.scale">linear</option>
  398.         <option name="charting.axisY.abbreviation">none</option>
  399.         <option name="charting.axisY.scale">linear</option>
  400.         <option name="charting.axisY2.abbreviation">none</option>
  401.         <option name="charting.axisY2.enabled">0</option>
  402.         <option name="charting.axisY2.scale">inherit</option>
  403.         <option name="charting.chart">line</option>
  404.         <option name="charting.chart.bubbleMaximumSize">50</option>
  405.         <option name="charting.chart.bubbleMinimumSize">10</option>
  406.         <option name="charting.chart.bubbleSizeBy">area</option>
  407.         <option name="charting.chart.nullValueMode">gaps</option>
  408.         <option name="charting.chart.showDataLabels">none</option>
  409.         <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
  410.         <option name="charting.chart.stackMode">default</option>
  411.         <option name="charting.chart.style">shiny</option>
  412.         <option name="charting.drilldown">none</option>
  413.         <option name="charting.layout.splitSeries">0</option>
  414.         <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
  415.         <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
  416.         <option name="charting.legend.mode">standard</option>
  417.         <option name="charting.legend.placement">right</option>
  418.         <option name="charting.lineWidth">2</option>
  419.         <option name="refresh.display">progressbar</option>
  420.         <option name="trellis.enabled">0</option>
  421.         <option name="trellis.scales.shared">1</option>
  422.         <option name="trellis.size">medium</option>
  423.       </chart>
  424.     </panel>
  425.   </row>
  426.   <row>
  427.     <panel>
  428.       <chart>
  429.         <search>
  430.           <query>index=main source="*access*"   | timechart span=1h dc(clientip) AS uv, count as pv</query>
  431.           <earliest>0</earliest>
  432.           <latest></latest>
  433.           <sampleRatio>1</sampleRatio>
  434.         </search>
  435.         <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
  436.         <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
  437.         <option name="charting.axisTitleX.visibility">visible</option>
  438.         <option name="charting.axisTitleY.visibility">visible</option>
  439.         <option name="charting.axisTitleY2.visibility">visible</option>
  440.         <option name="charting.axisX.abbreviation">none</option>
  441.         <option name="charting.axisX.scale">linear</option>
  442.         <option name="charting.axisY.abbreviation">none</option>
  443.         <option name="charting.axisY.scale">linear</option>
  444.         <option name="charting.axisY2.abbreviation">none</option>
  445.         <option name="charting.axisY2.enabled">0</option>
  446.         <option name="charting.axisY2.scale">inherit</option>
  447.         <option name="charting.chart">line</option>
  448.         <option name="charting.chart.bubbleMaximumSize">50</option>
  449.         <option name="charting.chart.bubbleMinimumSize">10</option>
  450.         <option name="charting.chart.bubbleSizeBy">area</option>
  451.         <option name="charting.chart.nullValueMode">gaps</option>
  452.         <option name="charting.chart.showDataLabels">none</option>
  453.         <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
  454.         <option name="charting.chart.stackMode">default</option>
  455.         <option name="charting.chart.style">shiny</option>
  456.         <option name="charting.drilldown">none</option>
  457.         <option name="charting.layout.splitSeries">0</option>
  458.         <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
  459.         <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
  460.         <option name="charting.legend.mode">standard</option>
  461.         <option name="charting.legend.placement">right</option>
  462.         <option name="charting.lineWidth">2</option>
  463.         <option name="refresh.display">progressbar</option>
  464.         <option name="trellis.enabled">0</option>
  465.         <option name="trellis.scales.shared">1</option>
  466.         <option name="trellis.size">medium</option>
  467.       </chart>
  468.     </panel>
  469.   </row>
  470.   <row>
  471.     <panel>
  472.       <single>
  473.         <search>
  474.           <query>index=main source="*access*" | stats count as pv, distinct_count(clientip) as uv, count(eval(status&gt;=400)) as fail_pv, count(eval(action="purchase")) as purchase_pv</query>
  475.           <earliest>0</earliest>
  476.           <latest></latest>
  477.           <sampleRatio>1</sampleRatio>
  478.         </search>
  479.         <option name="colorBy">value</option>
  480.         <option name="colorMode">none</option>
  481.         <option name="drilldown">none</option>
  482.         <option name="numberPrecision">0</option>
  483.         <option name="rangeColors">["0x006d9c","0xf1813f","0x53a051"]</option>
  484.         <option name="rangeValues">[0,1000]</option>
  485.         <option name="refresh.display">progressbar</option>
  486.         <option name="showSparkline">1</option>
  487.         <option name="showTrendIndicator">1</option>
  488.         <option name="trellis.enabled">1</option>
  489.         <option name="trellis.scales.shared">1</option>
  490.         <option name="trellis.size">medium</option>
  491.         <option name="trendColorInterpretation">standard</option>
  492.         <option name="trendDisplayMode">absolute</option>
  493.         <option name="unitPosition">after</option>
  494.         <option name="useColors">1</option>
  495.         <option name="useThousandSeparators">1</option>
  496.       </single>
  497.     </panel>
  498.   </row>
  499.   <row>
  500.     <panel>
  501.       <chart>
  502.         <search>
  503.           <query>source="*access*" | stats count(eval(method="GET")) AS GET, count(eval(method="POST")) AS POST BY referer_domain</query>
  504.           <earliest>0</earliest>
  505.           <sampleRatio>1</sampleRatio>
  506.         </search>
  507.         <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
  508.         <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
  509.         <option name="charting.axisTitleX.visibility">visible</option>
  510.         <option name="charting.axisTitleY.visibility">visible</option>
  511.         <option name="charting.axisTitleY2.visibility">visible</option>
  512.         <option name="charting.axisX.abbreviation">none</option>
  513.         <option name="charting.axisX.scale">linear</option>
  514.         <option name="charting.axisY.abbreviation">none</option>
  515.         <option name="charting.axisY.scale">linear</option>
  516.         <option name="charting.axisY2.abbreviation">none</option>
  517.         <option name="charting.axisY2.enabled">0</option>
  518.         <option name="charting.axisY2.scale">inherit</option>
  519.         <option name="charting.chart">column</option>
  520.         <option name="charting.chart.bubbleMaximumSize">50</option>
  521.         <option name="charting.chart.bubbleMinimumSize">10</option>
  522.         <option name="charting.chart.bubbleSizeBy">area</option>
  523.         <option name="charting.chart.nullValueMode">gaps</option>
  524.         <option name="charting.chart.showDataLabels">none</option>
  525.         <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
  526.         <option name="charting.chart.stackMode">stacked</option>
  527.         <option name="charting.chart.style">shiny</option>
  528.         <option name="charting.drilldown">none</option>
  529.         <option name="charting.layout.splitSeries">0</option>
  530.         <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
  531.         <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
  532.         <option name="charting.legend.mode">standard</option>
  533.         <option name="charting.legend.placement">right</option>
  534.         <option name="charting.lineWidth">2</option>
  535.         <option name="trellis.enabled">0</option>
  536.         <option name="trellis.scales.shared">1</option>
  537.         <option name="trellis.size">medium</option>
  538.       </chart>
  539.     </panel>
  540.   </row>
  541.   <row>
  542.     <panel>
  543.       <chart>
  544.         <search>
  545.           <query>index=main source="*access*" 
  546. |  timechart span=1d count as pv dc(clientip) as uv</query>
  547.           <earliest>0</earliest>
  548.           <latest></latest>
  549.           <sampleRatio>1</sampleRatio>
  550.         </search>
  551.         <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
  552.         <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
  553.         <option name="charting.axisTitleX.visibility">visible</option>
  554.         <option name="charting.axisTitleY.visibility">visible</option>
  555.         <option name="charting.axisTitleY2.visibility">visible</option>
  556.         <option name="charting.axisX.abbreviation">none</option>
  557.         <option name="charting.axisX.scale">linear</option>
  558.         <option name="charting.axisY.abbreviation">none</option>
  559.         <option name="charting.axisY.scale">linear</option>
  560.         <option name="charting.axisY2.abbreviation">none</option>
  561.         <option name="charting.axisY2.enabled">0</option>
  562.         <option name="charting.axisY2.scale">inherit</option>
  563.         <option name="charting.chart">column</option>
  564.         <option name="charting.chart.bubbleMaximumSize">50</option>
  565.         <option name="charting.chart.bubbleMinimumSize">10</option>
  566.         <option name="charting.chart.bubbleSizeBy">area</option>
  567.         <option name="charting.chart.nullValueMode">gaps</option>
  568.         <option name="charting.chart.showDataLabels">none</option>
  569.         <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
  570.         <option name="charting.chart.stackMode">stacked</option>
  571.         <option name="charting.chart.style">shiny</option>
  572.         <option name="charting.drilldown">none</option>
  573.         <option name="charting.layout.splitSeries">0</option>
  574.         <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
  575.         <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
  576.         <option name="charting.legend.mode">standard</option>
  577.         <option name="charting.legend.placement">right</option>
  578.         <option name="charting.lineWidth">2</option>
  579.         <option name="refresh.display">progressbar</option>
  580.         <option name="trellis.enabled">0</option>
  581.         <option name="trellis.scales.shared">1</option>
  582.         <option name="trellis.size">medium</option>
  583.       </chart>
  584.     </panel>
  585.   </row>
  586.   <row>
  587.     <panel>
  588.       <chart>
  589.         <search>
  590.           <query>sourcetype=access_* status &gt; 200
  591. |  eval bytes2=bytes%3, other=round(other/100, 0)
  592. |  head 10  | stats avg(bytes) by action, status, bytes2</query>
  593.           <earliest>0</earliest>
  594.           <latest>now</latest>
  595.           <sampleRatio>1</sampleRatio>
  596.         </search>
  597.         <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
  598.         <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
  599.         <option name="charting.axisTitleX.visibility">visible</option>
  600.         <option name="charting.axisTitleY.visibility">visible</option>
  601.         <option name="charting.axisTitleY2.visibility">visible</option>
  602.         <option name="charting.axisX.abbreviation">none</option>
  603.         <option name="charting.axisX.scale">linear</option>
  604.         <option name="charting.axisY.abbreviation">none</option>
  605.         <option name="charting.axisY.scale">linear</option>
  606.         <option name="charting.axisY2.abbreviation">none</option>
  607.         <option name="charting.axisY2.enabled">0</option>
  608.         <option name="charting.axisY2.scale">inherit</option>
  609.         <option name="charting.chart">bubble</option>
  610.         <option name="charting.chart.bubbleMaximumSize">50</option>
  611.         <option name="charting.chart.bubbleMinimumSize">10</option>
  612.         <option name="charting.chart.bubbleSizeBy">area</option>
  613.         <option name="charting.chart.nullValueMode">gaps</option>
  614.         <option name="charting.chart.showDataLabels">none</option>
  615.         <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
  616.         <option name="charting.chart.stackMode">default</option>
  617.         <option name="charting.chart.style">shiny</option>
  618.         <option name="charting.drilldown">none</option>
  619.         <option name="charting.layout.splitSeries">0</option>
  620.         <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
  621.         <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
  622.         <option name="charting.legend.mode">standard</option>
  623.         <option name="charting.legend.placement">right</option>
  624.         <option name="charting.lineWidth">2</option>
  625.         <option name="trellis.enabled">0</option>
  626.         <option name="trellis.scales.shared">1</option>
  627.         <option name="trellis.size">medium</option>
  628.       </chart>
  629.     </panel>
  630.   </row>
  631. </dashboard>

联动XML

  1. <form theme="light">
  2.   <label>表单</label>
  3.   <fieldset submitButton="false">
  4.     <input type="dropdown" token="sourcetype_tok">
  5.       <label>类型</label>
  6.       <fieldForLabel>sourcetype</fieldForLabel>
  7.       <fieldForValue>sourcetype</fieldForValue>
  8.       <search>
  9.         <query>index=_internal 
  10.           | dedup sourcetype</query>
  11.         <earliest>0</earliest>
  12.         <latest></latest>
  13.       </search>
  14.     </input>
  15.     <input type="time" token="time_tok" searchWhenChanged="true">
  16.       <label></label>
  17.       <default>
  18.         <earliest>-24h@h</earliest>
  19.         <latest>now</latest>
  20.       </default>
  21.     </input>
  22.   </fieldset>
  23.   <row>
  24.     <panel>
  25.       <chart>
  26.         <search>
  27.           <query>index = _internal sourcetype=$sourcetype_tok$
  28.             | timechart count by sourcetype</query>
  29.           <earliest>0</earliest>
  30.           <latest></latest>
  31.         </search>
  32.         <option name="charting.chart">column</option>
  33.         <option name="charting.drilldown">none</option>
  34.         <option name="refresh.display">progressbar</option>
  35.       </chart>
  36.     </panel>
  37.     <panel>
  38.       <single>
  39.         <title></title>
  40.         <search>
  41.           <query>index=_internal sourcetype=$sourcetype_tok$
  42.             | stats count as sourcetype</query>
  43.           <earliest>$time_tok.earliest$</earliest>
  44.           <latest>$time_tok.latest$</latest>
  45.         </search>
  46.         <option name="drilldown">none</option>
  47.         <option name="refresh.display">progressbar</option>
  48.       </single>
  49.     </panel>
  50.   </row>
  51.   <row>
  52.     <panel>
  53.       <chart>
  54.         <title>Pan and Zoom (All source types)</title>
  55.         <search>
  56.           <query>index=_internal | timechart count by sourcetype</query>
  57.           <earliest>-24h@h</earliest>
  58.           <latest>now</latest>
  59.         </search>
  60.         <selection>
  61.           <set token="selection_earliest">$start$</set>
  62.           <set token="selection_latest">$end$</set>
  63.           <set token="start_splunk_web_access">$start.splunk_web_access$</set>
  64.           <set token="end_splunk_web_access">$end.splunk_web_access$</set>
  65.         </selection>
  66.         <option name="refresh.display">progressbar</option>
  67.       </chart>
  68.     </panel>
  69.     <panel>
  70.       <chart>
  71.         <title>Pan and Zoom (Web access source type)</title>
  72.         <search>
  73.           <query>
  74.             index=_internal sourcetype=splunk_web_access
  75.             |  timechart count by sourcetype
  76.           </query>
  77.           <earliest>$selection_earliest$</earliest>
  78.           <latest>$selection_latest$</latest>
  79.         </search>
  80.       </chart>
  81.     </panel>
  82.   </row>
  83.   <row>
  84.     <panel>
  85.       <html>
  86.         <h3>Token values for the splunk_web_access selection</h3>        
  87.         <table border="0" cellpadding="12" cellspacing="0">
  88.           <tr>
  89.             <td>
  90.               <p>
  91.                 <b>Time range (epoch time)</b>
  92.               </p>
  93.               <p>
  94.                 <b>$$selection_earliest$$</b>: $selection_earliest$
  95.                 <br/>
  96.                 <b>$$selection_latest$$</b>: $selection_latest$</p>
  97.             </td>
  98.             <td>
  99.               <p>
  100.                 <b>Count at the begining and end of time range.</b>
  101.               </p>
  102.               <p>
  103.                 <b>$$start_splunk_web_access$$</b>: $start_splunk_web_access$
  104.                 <br/>
  105.                 <b>$$end_splunk_web_access$$</b>: $end_splunk_web_access$</p>
  106.             </td>
  107.           </tr>
  108.         </table>      
  109.       </html>
  110.     </panel>
  111.   </row>
  112. </form>