topic Counting Events and then finding the sum? in Splunk Search

Counting Events and then finding the sum?

asarran — Thu, 03 Nov 2016 14:57:21 GMT

Good Morning, Fellow Splunkers

I'm interested in counting events per hour for a 24 hr period. I would also like to have a sum total count for the end of the period. So within that hour how many alerts have been generated?

Time Alert
1h.............3
2h.............3
3h.............2
4h.............2
5h.............9
.
.
.
.
24h............(19) Sum

My search Query:
index=* host=* myalert=* |timechart span=1h count by host

Re: Counting Events and then finding the sum?

somesoni2 — Thu, 03 Nov 2016 15:00:12 GMT

Something like this

index= host= myalert=* |timechart span=1h count by host | addcoltotals

Re: Counting Events and then finding the sum?

gwobben — Thu, 03 Nov 2016 15:25:26 GMT

Give this a shot, it will give you the counts per hour and an extra row to sum up the total of the day:

| tstats count WHERE index=_internal GROUPBY _time span=1h
| appendpipe [timechart span=24h sum(count) as total]
| sort _time

If you don't want to use tstats (which can be up to 1000x times faster than a regular search) you can do this:

index=_internal 
| timechart span=1h count
| appendpipe [timechart span=24h sum(count) as total]
| sort _time