https://community.splunk.com/t5/Splunk-Search/graph-only-cumulative-data-with-timechart-and-streamstats/m-p/171546#M49166 <P>Just add a table/fields command to remove other columns.</P> <P>Query version from Blogpost</P> <PRE><CODE>index=_internal group="per_index_thruput" earliest=@d latest=@h | eval mb=kb/1024 | timechart span=1h sum(mb) as HourlyTotal by series | addtotals fieldname=HourlyTotal | streamstats sum(HourlyTotal) AS AccumulatedTOTAL | table _time AccumulatedTOTAL </CODE></PRE> <P>Another version</P> <PRE><CODE> index=_internal group="per_index_thruput" earliest=@d latest=@h | eval mb=kb/1024 | timechart span=1h sum(mb) as HourlyTotal | streamstats sum(HourlyTotal) AS AccumulatedTOTAL | table _time AccumulatedTOTAL </CODE></PRE> Mon, 09 Mar 2015 19:37:38 GMT somesoni2 2015-03-09T19:37:38Z https://community.splunk.com/t5/Splunk-Search/graph-only-cumulative-data-with-timechart-and-streamstats/m-p/171545#M49165 <P>I've found this on the Splunk wiki that gives great examples on how to graph several sources and their cumulative totals: <A href="http://wiki.splunk.com/Community:Search_Report:_How_To_Create_a_Chart_of_Hourly_and_Accumulated_Index_Volume">http://wiki.splunk.com/Community:Search_Report:_How_To_Create_a_Chart_of_Hourly_and_Accumulated_Index_Volume</A></P> <P>Is it possible to use a similar method, but to only graph the cumulative total and not each of the individual sources that make up that total?</P> Mon, 09 Mar 2015 18:58:05 GMT https://community.splunk.com/t5/Splunk-Search/graph-only-cumulative-data-with-timechart-and-streamstats/m-p/171545#M49165 bill_bartlett 2015-03-09T18:58:05Z https://community.splunk.com/t5/Splunk-Search/graph-only-cumulative-data-with-timechart-and-streamstats/m-p/171546#M49166 <P>Just add a table/fields command to remove other columns.</P> <P>Query version from Blogpost</P> <PRE><CODE>index=_internal group="per_index_thruput" earliest=@d latest=@h | eval mb=kb/1024 | timechart span=1h sum(mb) as HourlyTotal by series | addtotals fieldname=HourlyTotal | streamstats sum(HourlyTotal) AS AccumulatedTOTAL | table _time AccumulatedTOTAL </CODE></PRE> <P>Another version</P> <PRE><CODE> index=_internal group="per_index_thruput" earliest=@d latest=@h | eval mb=kb/1024 | timechart span=1h sum(mb) as HourlyTotal | streamstats sum(HourlyTotal) AS AccumulatedTOTAL | table _time AccumulatedTOTAL </CODE></PRE> Mon, 09 Mar 2015 19:37:38 GMT https://community.splunk.com/t5/Splunk-Search/graph-only-cumulative-data-with-timechart-and-streamstats/m-p/171546#M49166 somesoni2 2015-03-09T19:37:38Z https://community.splunk.com/t5/Splunk-Search/graph-only-cumulative-data-with-timechart-and-streamstats/m-p/171547#M49167 <P>Thank you, this is almost perfect. Is there a way to format the time bucket on the chart? As it is now, the format makes for a very ugly chart if graphing more than a handful of columns. </P> Mon, 09 Mar 2015 19:50:17 GMT https://community.splunk.com/t5/Splunk-Search/graph-only-cumulative-data-with-timechart-and-streamstats/m-p/171547#M49167 bill_bartlett 2015-03-09T19:50:17Z https://community.splunk.com/t5/Splunk-Search/graph-only-cumulative-data-with-timechart-and-streamstats/m-p/171548#M49168 <P>I've figured it out. This search works perfect for my needs:</P> <PRE><CODE>index=_internal group="per_index_thruput" earliest=@d latest=@h | eval mb=kb/1024 | timechart span=1h sum(mb) as HourlyTotal by series | addtotals fieldname=HourlyTotal | streamstats sum(HourlyTotal) AS AccumulatedTOTAL | table _time AccumulatedTOTAL | eval _time=strftime(_time, "%m/%d %H:%M") </CODE></PRE> Mon, 09 Mar 2015 20:00:50 GMT https://community.splunk.com/t5/Splunk-Search/graph-only-cumulative-data-with-timechart-and-streamstats/m-p/171548#M49168 bill_bartlett 2015-03-09T20:00:50Z