topic Re: How can i calculate sum of values from different hosts in Splunk Search

How can i calculate sum of values from different hosts

mishaaaaaaaaaa — Wed, 06 Feb 2019 07:41:38 GMT

Hi, splunkers!
I have 4 hosts, and i need to culculate total sum of values contained in each event
In other words i have:
host1: value1
host2: value2
host3: value3
host4: value4
and i need to calculate value1+value2+value3+value4 and display it in Single Value splunk visualisation
i try to do it like this:
index=myIndex host=host1 OR host=host2 OR host=host3 OR host=host4
| timechart max(value) by host as "Total Max Value"

but i have max value from all hosts displayed

Re: How can i calculate sum of values from different hosts

chrisyounger — Wed, 06 Feb 2019 07:45:02 GMT

hi @mishaaaaaaaaaa

Try this index=myIndex host=host1 OR host=host2 OR host=host3 OR host=host4| stats sum(value) as "Total Max Value"

Good luck!

Re: How can i calculate sum of values from different hosts

mishaaaaaaaaaa — Wed, 06 Feb 2019 07:55:48 GMT

i tryed to do it like you suggested, but in this case i have sum of values by all period
and i need value by the current moment

Re: How can i calculate sum of values from different hosts

chrisyounger — Wed, 06 Feb 2019 07:57:46 GMT

Can you just change the timepicker to be "last 15 minutes"? Does that do what you want?

Re: How can i calculate sum of values from different hosts

mishaaaaaaaaaa — Wed, 06 Feb 2019 08:08:14 GMT

I need to see statistic by 2 hour but display only current value at the moment but not a sum of values since the system have been started

Re: How can i calculate sum of values from different hosts

chrisyounger — Wed, 06 Feb 2019 08:13:46 GMT

ok I understand now. Try this index=myIndex host=host1 OR host=host2 OR host=host3 OR host=host4| stats latest(value) as "Latest Value"

Re: How can i calculate sum of values from different hosts

mishaaaaaaaaaa — Wed, 06 Feb 2019 14:04:35 GMT

No, this doesn't work
i found something like this, but it also works bad

index=myIndex | bucket _time span=2h | stats max($module$.metric.sampleCount) as metricValueFromAllHosts by host, _time | timechart span=2h sum(metricValueFromAllHosts)

this solution correctly display the sum of metric.sampleCount from all hasts, but doesn't display statistic like if i had metric.sampleCount=16 two hours ago and now i have 32, it shows 0 always

Re: How can i calculate sum of values from different hosts

chrisyounger — Wed, 06 Feb 2019 18:55:47 GMT

OK last try. What about index=myIndex host=host1 OR host=host2 OR host=host3 OR host=host4| stats latest(value) as latest by host | stats sum(latest)

Re: How can i calculate sum of values from different hosts

mishaaaaaaaaaa — Thu, 07 Feb 2019 06:25:31 GMT

No, this doesn't work too
Your solution calculates only sum of metrics from all hosts at the current moment and dysplay them
But i need sum of metrics from all hosts at the current moment and statistic like from earliest bound of period till latest bound of period we have increase sum of metrics on 16 for example, so in the earliest bound we had 12 and in latest we have 28
And single value visualisation allows us to display such statistic

Re: How can i calculate sum of values from different hosts

vishaltaneja070 — Thu, 07 Feb 2019 07:35:04 GMT

@mishaaaaaaaaaa

Try something like this:

    index=myIndex host=host1 OR host=host2 OR host=host3 OR host=host4| stats sum(value) as latest by host | stats sum(latest)

Re: How can i calculate sum of values from different hosts

mishaaaaaaaaaa — Fri, 08 Feb 2019 06:05:54 GMT

Thanks a lot for everyone for your answers, the problem was because my metric accumulates to previous values.
In my case this solution works correct:
index=someIndex | bucket _time | stats max(metric.sampleCount) as metricValueFromAllHosts by host, _time | timechart sum(metricValueFromAllHosts)