topic Re: sum of a value within a period of 15 min in Splunk Enterprise https://community.splunk.com/t5/Splunk-Enterprise/How-to-get-sum-of-a-value-within-a-period-of-15-min/m-p/627445#M15136 <P>&nbsp;</P><P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp; not getting result</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="chandankr_0-1674042654230.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/23415i5F313BF9DF40A5FA/image-size/medium?v=v2&amp;px=400" role="button" title="chandankr_0-1674042654230.png" alt="chandankr_0-1674042654230.png" /></span></P><P>&nbsp;</P><P>&nbsp;</P> Wed, 18 Jan 2023 11:51:15 GMT chandankr 2023-01-18T11:51:15Z How to get sum of a value within a period of 15 min? https://community.splunk.com/t5/Splunk-Enterprise/How-to-get-sum-of-a-value-within-a-period-of-15-min/m-p/627326#M15116 <P>I have an input of value is like an odometer so it's cumulative. I collect a sample every 15 minutes. If I want to create a timechart that shows the total value of 15 min duration. how would I do that? See example below.</P> <P>1/17/2023 0:01:00 value 6<BR />1/17/2023 0:02:00 value 6<BR />1/17/2023 0:03:00 value 6<BR />1/17/2023 0:09:00 value 7<BR />1/17/2023 0:10:00 value 6<BR />1/17/2023 0:11:00 value 7<BR />1/17/2023 0:12:00 value 8<BR />1/17/2023 0:15:00 value 8</P> <P><BR />from 1 minute to 15 minute total value is 54</P> <P>1/17/2023 0:16:00 value 5<BR />1/17/2023 0:17:00 value 8<BR />1/17/2023 0:18:00 value 5<BR />1/17/2023 0:29:00 value 7<BR />1/17/2023 0:30:00 value 5</P> <P>from 16 minute to 30 minute total value is 30</P> Tue, 17 Jan 2023 20:25:45 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-get-sum-of-a-value-within-a-period-of-15-min/m-p/627326#M15116 chandankr 2023-01-17T20:25:45Z Re: sum of a value within a period of 15 min https://community.splunk.com/t5/Splunk-Enterprise/How-to-get-sum-of-a-value-within-a-period-of-15-min/m-p/627328#M15117 <P>Try something like this</P><LI-CODE lang="markup">| timechart span=15m sum(value)</LI-CODE> Tue, 17 Jan 2023 10:20:32 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-get-sum-of-a-value-within-a-period-of-15-min/m-p/627328#M15117 ITWhisperer 2023-01-17T10:20:32Z Re: sum of a value within a period of 15 min https://community.splunk.com/t5/Splunk-Enterprise/How-to-get-sum-of-a-value-within-a-period-of-15-min/m-p/627413#M15131 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp;this is not working&nbsp;</P> Wed, 18 Jan 2023 03:31:05 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-get-sum-of-a-value-within-a-period-of-15-min/m-p/627413#M15131 chandankr 2023-01-18T03:31:05Z Re: sum of a value within a period of 15 min https://community.splunk.com/t5/Splunk-Enterprise/How-to-get-sum-of-a-value-within-a-period-of-15-min/m-p/627415#M15132 <P>Why/how?</P><P>What does it give you?</P> Wed, 18 Jan 2023 04:03:12 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-get-sum-of-a-value-within-a-period-of-15-min/m-p/627415#M15132 bowesmana 2023-01-18T04:03:12Z Re: sum of a value within a period of 15 min https://community.splunk.com/t5/Splunk-Enterprise/How-to-get-sum-of-a-value-within-a-period-of-15-min/m-p/627445#M15136 <P>&nbsp;</P><P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp; not getting result</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="chandankr_0-1674042654230.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/23415i5F313BF9DF40A5FA/image-size/medium?v=v2&amp;px=400" role="button" title="chandankr_0-1674042654230.png" alt="chandankr_0-1674042654230.png" /></span></P><P>&nbsp;</P><P>&nbsp;</P> Wed, 18 Jan 2023 11:51:15 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-get-sum-of-a-value-within-a-period-of-15-min/m-p/627445#M15136 chandankr 2023-01-18T11:51:15Z Re: sum of a value within a period of 15 min https://community.splunk.com/t5/Splunk-Enterprise/How-to-get-sum-of-a-value-within-a-period-of-15-min/m-p/627447#M15137 <P>You need to use only one timechart command</P><LI-CODE lang="markup">| timechart span=15m sum(active_state) as active_state sum(idle_state) as idle_state</LI-CODE> Wed, 18 Jan 2023 12:02:52 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-get-sum-of-a-value-within-a-period-of-15-min/m-p/627447#M15137 ITWhisperer 2023-01-18T12:02:52Z Re: sum of a value within a period of 15 min https://community.splunk.com/t5/Splunk-Enterprise/How-to-get-sum-of-a-value-within-a-period-of-15-min/m-p/627546#M15145 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp; still no result</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="chandankr_0-1674109931455.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/23435i4CA46F06B63DF059/image-size/medium?v=v2&amp;px=400" role="button" title="chandankr_0-1674109931455.png" alt="chandankr_0-1674109931455.png" /></span></P><P>&nbsp;</P> Thu, 19 Jan 2023 06:32:55 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-get-sum-of-a-value-within-a-period-of-15-min/m-p/627546#M15145 chandankr 2023-01-19T06:32:55Z Re: sum of a value within a period of 15 min https://community.splunk.com/t5/Splunk-Enterprise/How-to-get-sum-of-a-value-within-a-period-of-15-min/m-p/627556#M15146 <P>Looks like your extract is not working. Can you share some raw events in a code block?</P> Thu, 19 Jan 2023 09:16:58 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-get-sum-of-a-value-within-a-period-of-15-min/m-p/627556#M15146 ITWhisperer 2023-01-19T09:16:58Z