https://community.splunk.com/t5/Splunk-Search/How-to-find-spike-in-total-count-of-a-field/m-p/484317#M135567 <P>I'd like to be able to search for the following:</P> <PRE><CODE>1) timechart over X days for the sum of the count of a field 2) spikes or % increase for the sum of the count of a field compared to previous hour, day, week, etc </CODE></PRE> <P>For example, we are ingesting Palo logs and I'd like to be able to see what fields have the highest sum/total for the time period I run and then also see the % increase/decrease of the sum/total for the field as well compared to an hour/day/week/etc.</P> <P>Not looking to break the count of the field using 'BY', but just interested in the sum/total of all events for a field</P> <P>Thx</P> Wed, 13 Nov 2019 02:16:54 GMT jwalzerpitt 2019-11-13T02:16:54Z https://community.splunk.com/t5/Splunk-Search/How-to-find-spike-in-total-count-of-a-field/m-p/484317#M135567 <P>I'd like to be able to search for the following:</P> <PRE><CODE>1) timechart over X days for the sum of the count of a field 2) spikes or % increase for the sum of the count of a field compared to previous hour, day, week, etc </CODE></PRE> <P>For example, we are ingesting Palo logs and I'd like to be able to see what fields have the highest sum/total for the time period I run and then also see the % increase/decrease of the sum/total for the field as well compared to an hour/day/week/etc.</P> <P>Not looking to break the count of the field using 'BY', but just interested in the sum/total of all events for a field</P> <P>Thx</P> Wed, 13 Nov 2019 02:16:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-spike-in-total-count-of-a-field/m-p/484317#M135567 jwalzerpitt 2019-11-13T02:16:54Z https://community.splunk.com/t5/Splunk-Search/How-to-find-spike-in-total-count-of-a-field/m-p/484318#M135568 <P>Pipe the results of your query to "fieldsummary", which by default provides both "count" and "distinct_count".<BR /> I think this will get you the data you're after, based on your question.</P> <P>See this documentation for more detailed explanation:<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Fieldsummary">https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Fieldsummary</A></P> Fri, 15 Nov 2019 04:43:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-spike-in-total-count-of-a-field/m-p/484318#M135568 codebuilder 2019-11-15T04:43:03Z