topic Re: How do you sum values by day? in Splunk Search

How do you sum values by day?

jyar1 — Tue, 08 Jan 2019 10:34:48 GMT

Hi,

I'm new to Splunk and have written a simple search to see 4 trending values over a month.

auditSource XXX auditType XXX  "detail.serviceName"="XXX" | timechart count by detail.adminMessageType

This gives me the values per day of 4 different admin message types e,g

              Message 1     Message 2     Message 3     Message 4
01/01/19           5                 10             4             7
02/01/19          15                 20            7             15
03/01/19           8                   3              6              16

When this converts to a line chart in visualizations, it shows me the value per day. I want it to report the total per message as the month goes on so you see the cumulative values. e.g

        Message 1     Message 2     Message 3     Message 4
01/01/19   5                 10       4             7
02/01/19   20                30          11            22
03/01/19   28                33             17          34

Can anyone help?

Cheers

Re: How do you sum values by day?

renjith_nair — Tue, 08 Jan 2019 12:33:15 GMT

@jyar1,

Try this

 auditSource XXX auditType XXX "detail.serviceName"="XXX" | timechart count by detail.adminMessageType
|untable _time,detail.adminMessageType,count
|streamstats sum(count) as count |xyseries _time,detail.adminMessageType,count

Re: How do you sum values by day?

jyar1 — Tue, 08 Jan 2019 13:02:39 GMT

Thankyou does exactly what i want - however is there a way for formatting the X Axis in the visualization to remove the timestamp and just show the date?

i.e - it shows | 2019-01-01 T00:00:00+00:00 | 2019-01-02 T00:00:00+00:00
Can it be formatted to show
2019-01-01 | 2019-01-02 | 2019-01-03

Re: How do you sum values by day?

renjith_nair — Tue, 08 Jan 2019 13:56:29 GMT

yes, sure. Add below to the end of the search

eval _time=strftime(_time,"%Y-%m-%d")