https://community.splunk.com/t5/Splunk-Search/How-to-graph-the-sum-of-field-A-where-field-B-TRUE-and-field-C/m-p/201050#M58273 <P>The question is the simple case of one set of conditions. My goal is to line graph (4) variations in one chart:</P> <P>sum field A where field B=TRUE and field C=FALSE as outbound<BR /> sum field A where field B=FALSE and field C=TRUE as inbound<BR /> sum field A where field B=TRUE and field C=TRUE as internal<BR /> sum field A where field B=FALSE and field C=FALSE as passthru<BR /> pipe into a timechart by day.</P> <P>This working Splunk search charts the number of records that satisfies each of the 4 tests, but I can't figure out how to sum the Field A (producer_filename_bytes) of those matching records to line chart the 4 cumulative bytes of each?</P> <PRE><CODE>index=prd_sterling sourcetype="sfg:fg_activity" state=Routed | timechart per_day(eval(producer_is_internal="TRUE" and consumer_is_internal="FALSE")) AS TotalOutbound, per_day(eval(producer_is_internal="FALSE" and consumer_is_internal="TRUE")) AS TotalInbound, per_day(eval(producer_is_internal="TRUE" and consumer_is_internal="TRUE")) AS TotalInternal, per_day(eval(producer_is_internal="FALSE" and consumer_is_internal="FALSE")) AS TotalPassThru </CODE></PRE> <P>Thanks very much! -Marc</P> Tue, 29 Sep 2020 09:54:10 GMT marcoeur5 2020-09-29T09:54:10Z https://community.splunk.com/t5/Splunk-Search/How-to-graph-the-sum-of-field-A-where-field-B-TRUE-and-field-C/m-p/201050#M58273 <P>The question is the simple case of one set of conditions. My goal is to line graph (4) variations in one chart:</P> <P>sum field A where field B=TRUE and field C=FALSE as outbound<BR /> sum field A where field B=FALSE and field C=TRUE as inbound<BR /> sum field A where field B=TRUE and field C=TRUE as internal<BR /> sum field A where field B=FALSE and field C=FALSE as passthru<BR /> pipe into a timechart by day.</P> <P>This working Splunk search charts the number of records that satisfies each of the 4 tests, but I can't figure out how to sum the Field A (producer_filename_bytes) of those matching records to line chart the 4 cumulative bytes of each?</P> <PRE><CODE>index=prd_sterling sourcetype="sfg:fg_activity" state=Routed | timechart per_day(eval(producer_is_internal="TRUE" and consumer_is_internal="FALSE")) AS TotalOutbound, per_day(eval(producer_is_internal="FALSE" and consumer_is_internal="TRUE")) AS TotalInbound, per_day(eval(producer_is_internal="TRUE" and consumer_is_internal="TRUE")) AS TotalInternal, per_day(eval(producer_is_internal="FALSE" and consumer_is_internal="FALSE")) AS TotalPassThru </CODE></PRE> <P>Thanks very much! -Marc</P> Tue, 29 Sep 2020 09:54:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-graph-the-sum-of-field-A-where-field-B-TRUE-and-field-C/m-p/201050#M58273 marcoeur5 2020-09-29T09:54:10Z https://community.splunk.com/t5/Splunk-Search/How-to-graph-the-sum-of-field-A-where-field-B-TRUE-and-field-C/m-p/201051#M58274 <P>Try like this </P> <PRE><CODE>index=prd_sterling sourcetype="sfg:fg_activity" state=Routed | eval Outbound=if(producer_is_internal="TRUE" and consumer_is_internal="FALSE",producer_filename_bytes,0) | eval Inbound=if(producer_is_internal="FALSE" and consumer_is_internal="TRUE",producer_filename_bytes,0) | eval Internal=if(producer_is_internal="TRUE" and consumer_is_internal="TRUE",producer_filename_bytes,0) | eval PassThru=if(producer_is_internal="FALSE" and consumer_is_internal="FALSE",producer_filename_bytes,0) | | timechart per_day(Outbound) as TotalOutbound per_day(Inbound) as TotalInbound per_day(Internal) AS TotalInternal, per_day(PassThru) AS TotalPassThru </CODE></PRE> Wed, 08 Jun 2016 16:46:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-graph-the-sum-of-field-A-where-field-B-TRUE-and-field-C/m-p/201051#M58274 somesoni2 2016-06-08T16:46:47Z https://community.splunk.com/t5/Splunk-Search/How-to-graph-the-sum-of-field-A-where-field-B-TRUE-and-field-C/m-p/201052#M58275 <P>Thanks somesoni2! That works perfectly. Really appreciate the assist. </P> <P>FYI to others, remove the second pipe ahead of the timechart command. </P> Wed, 08 Jun 2016 17:18:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-graph-the-sum-of-field-A-where-field-B-TRUE-and-field-C/m-p/201052#M58275 marcoeur5 2016-06-08T17:18:28Z https://community.splunk.com/t5/Splunk-Search/How-to-graph-the-sum-of-field-A-where-field-B-TRUE-and-field-C/m-p/201053#M58276 <P>Hi @marcoeur5</P> <P>Glad you found an answer through @somesoni2 <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> Don't forget to resolve the post by clicking "Accept" directly below his answer. Also, be sure to upvote his answer for helping you out.</P> <P>Cheers<BR /> Patrick</P> Wed, 08 Jun 2016 17:30:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-graph-the-sum-of-field-A-where-field-B-TRUE-and-field-C/m-p/201053#M58276 ppablo 2016-06-08T17:30:47Z