https://community.splunk.com/t5/Splunk-Search/Accum-timeseries-and-grouping/m-p/45356#M179299 <P>ah, thanks! I was mentally stuck on accum, which is clearly the wrong tool here.</P> Wed, 08 Sep 2010 06:48:09 GMT Oren 2010-09-08T06:48:09Z https://community.splunk.com/t5/Splunk-Search/Accum-timeseries-and-grouping/m-p/45354#M179297 <P>From our weblogs, I have extracted fields including http_bytes and http_domain. I would like to get a stacked chart of bandwidth consumed (accum http_bytes) by http_domain. My naive attempts have ended comically. </P> <P>Related, I'd like to see for a given http_domain, I'm looking for two queries: how much bandwidth it used both for the search period, and a timechart for just that app. </P> Wed, 08 Sep 2010 00:29:54 GMT https://community.splunk.com/t5/Splunk-Search/Accum-timeseries-and-grouping/m-p/45354#M179297 Oren 2010-09-08T00:29:54Z https://community.splunk.com/t5/Splunk-Search/Accum-timeseries-and-grouping/m-p/45355#M179298 <P>I think it should just be:</P> <PRE><CODE>sourcetype=myweblogs | chart sum(http_bytes) by http_domain </CODE></PRE> <P>and</P> <PRE><CODE>sourcetype=myweblogs http_domain="my_domain" | stats sum(http_bytes) sourcetype=myweblogs http_domain="my_domain" | timechart span=5min sum(http_bytes) </CODE></PRE> Wed, 08 Sep 2010 05:57:41 GMT https://community.splunk.com/t5/Splunk-Search/Accum-timeseries-and-grouping/m-p/45355#M179298 gkanapathy 2010-09-08T05:57:41Z https://community.splunk.com/t5/Splunk-Search/Accum-timeseries-and-grouping/m-p/45356#M179299 <P>ah, thanks! I was mentally stuck on accum, which is clearly the wrong tool here.</P> Wed, 08 Sep 2010 06:48:09 GMT https://community.splunk.com/t5/Splunk-Search/Accum-timeseries-and-grouping/m-p/45356#M179299 Oren 2010-09-08T06:48:09Z