https://community.splunk.com/t5/Splunk-Search/how-to-sum-all-average-values-within-the-hour-and-timechart-only/m-p/205292#M59674 <P>that did it! thank you again!</P> Thu, 14 Apr 2016 19:52:03 GMT kamgineer 2016-04-14T19:52:03Z https://community.splunk.com/t5/Splunk-Search/how-to-sum-all-average-values-within-the-hour-and-timechart-only/m-p/205286#M59668 <P>I guess my question is a little hard to explain... so let me start by giving you an example of the data I'm working with:</P> <PRE><CODE>2016-04-14 09:12:02.393040 VolID=164 Name=qai-mqa2qa alloc=4000 used=0 service=mssql database=qai-qa 2016-04-14 09:12:02.393040 VolID=162 Name=sf-ny2-vm-win-9 alloc=2000 used=937 service=vmware vmware_os=windows 2016-04-14 09:12:02.393040 VolID=157 Name=sf-ny2-vm-win-10 alloc=2000 used=343 service=vmware vmware_os=windows 2016-04-14 09:12:02.393040 VolID=156 Name=exchange-ex23-1 alloc=2000 used=805 service=exchange 2016-04-14 10:12:02.393040 VolID=164 Name=qai-mqa2qa alloc=4000 used=0 service=mssql database=qai-qa 2016-04-14 10:12:02.393040 VolID=162 Name=sf-ny2-vm-win-9 alloc=2000 used=937 service=vmware vmware_os=windows 2016-04-14 10:12:02.393040 VolID=157 Name=sf-ny2-vm-win-10 alloc=2000 used=343 service=vmware vmware_os=windows 2016-04-14 10:12:02.393040 VolID=156 Name=exchange-ex23-1 alloc=2000 used=805 service=exchange 2016-04-14 11:12:02.393040 VolID=164 Name=qai-mqa2qa alloc=4000 used=0 service=mssql database=qai-qa 2016-04-14 11:12:02.393040 VolID=162 Name=sf-ny2-vm-win-9 alloc=2000 used=937 service=vmware vmware_os=windows 2016-04-14 11:12:02.393040 VolID=157 Name=sf-ny2-vm-win-10 alloc=2000 used=343 service=vmware vmware_os=windows 2016-04-14 11:12:02.393040 VolID=156 Name=exchange-ex23-1 alloc=2000 used=805 service=exchange </CODE></PRE> <P>So, "about" every hour I send the above data to Splunk. I say "about" every hour because it can sometimes be several times an hour. The only unique thing about every "dump" is the exact time stamp. For every "dump" data, all of the time stamps will be the same for that dump. </P> <P>Is there a way to sum up all of the data by "service" for every uniq dump?</P> <P>For example. something like this works (except for the time when there is more than one "dump" per hour):</P> <PRE><CODE>index=solidfire service host=sf.ny2.hcmny.com| timechart span=1hr sum(used) by service </CODE></PRE> <P>And for part 2 of the question, how would i only display the "most recent" sum?<BR /> Something like this works, but when I put it in a dashboard, the sum seems to grow to a cumulative sum, instead of the "latest" sum:</P> <PRE><CODE>index=solidfire service host=sf.ny2.hcmny.com| timechart span=1hr sum(used) by service |tail 1 </CODE></PRE> <P>So I want my end result to look something like this:<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/1242i01C50D591A9C28F8/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Thu, 14 Apr 2016 13:59:21 GMT https://community.splunk.com/t5/Splunk-Search/how-to-sum-all-average-values-within-the-hour-and-timechart-only/m-p/205286#M59668 kamgineer 2016-04-14T13:59:21Z https://community.splunk.com/t5/Splunk-Search/how-to-sum-all-average-values-within-the-hour-and-timechart-only/m-p/205287#M59669 <P>Answer 1 : Use this to group your summary by the dumps (assuming same timestamp as stated)<BR /> <STRONG>Updated</STRONG> corrected typo on over_time, it should be over _time</P> <PRE><CODE> index=solidfire service host=sf.ny2.hcmny.com | bucket span=1m _time |chart sum(used) over _time by service </CODE></PRE> <P>Answer 2: MOst recent sum</P> <P>Working query:</P> <PRE><CODE> index=solidfire service host=sf.ny2.hcmny.com | eventstats max(_time) as max by service | where _time=max | stats sum(used) by service </CODE></PRE> <P>other attempts</P> <PRE><CODE> index=solidfire service host=sf.ny2.hcmny.com | bucket span=1m _time | dedup _time | stats sum(used) by service </CODE></PRE> <P>OR</P> <PRE><CODE> index=solidfire service host=sf.ny2.hcmny.com | bucket span=1m _time | stats latest(used) as used by service | stats sum(used) by service </CODE></PRE> Thu, 14 Apr 2016 19:11:46 GMT https://community.splunk.com/t5/Splunk-Search/how-to-sum-all-average-values-within-the-hour-and-timechart-only/m-p/205287#M59669 somesoni2 2016-04-14T19:11:46Z https://community.splunk.com/t5/Splunk-Search/how-to-sum-all-average-values-within-the-hour-and-timechart-only/m-p/205288#M59670 <P>hi, and thank you!</P> <P>So Answer #1 looks good, I didn't know about the "over _time" command, thank you, </P> <P>Answer #2 on the other hand does not give me the right results, the sum numbers are definitely wrong, see stats below:</P> <PRE><CODE>service sum(used) dpm 1662 exchange 804 mssql 1 oracle 7516 vmware 277 </CODE></PRE> Thu, 14 Apr 2016 19:34:58 GMT https://community.splunk.com/t5/Splunk-Search/how-to-sum-all-average-values-within-the-hour-and-timechart-only/m-p/205288#M59670 kamgineer 2016-04-14T19:34:58Z https://community.splunk.com/t5/Splunk-Search/how-to-sum-all-average-values-within-the-hour-and-timechart-only/m-p/205289#M59671 <P>For Answer 2, which query did you try?</P> Thu, 14 Apr 2016 19:38:26 GMT https://community.splunk.com/t5/Splunk-Search/how-to-sum-all-average-values-within-the-hour-and-timechart-only/m-p/205289#M59671 somesoni2 2016-04-14T19:38:26Z https://community.splunk.com/t5/Splunk-Search/how-to-sum-all-average-values-within-the-hour-and-timechart-only/m-p/205290#M59672 <P>i tried both:</P> <P>1) <CODE>index=solidfire service host=sf.ny2.hcmny.com | bucket span=1m _time | dedup _time | stats sum(used) by service</CODE><BR /> results:</P> <PRE><CODE>service sum(used) dpm 5995 exchange 4338 mssql 1180 oracle 0 vmware 57555 </CODE></PRE> <P>2) <CODE>index=solidfire service host=sf.ny2.hcmny.com | bucket span=1m _time | stats latest(used) as used by service | stats sum(used) by service</CODE><BR /> results:</P> <PRE><CODE>service sum(used) dpm 1662 exchange 804 mssql 1 oracle 7516 vmware 277 </CODE></PRE> Thu, 14 Apr 2016 19:41:23 GMT https://community.splunk.com/t5/Splunk-Search/how-to-sum-all-average-values-within-the-hour-and-timechart-only/m-p/205290#M59672 kamgineer 2016-04-14T19:41:23Z https://community.splunk.com/t5/Splunk-Search/how-to-sum-all-average-values-within-the-hour-and-timechart-only/m-p/205291#M59673 <P>Give this a try </P> <PRE><CODE>index=solidfire service host=sf.ny2.hcmny.com | eventstats max(_time) as max by service | where _time=max | stats sum(used) by service </CODE></PRE> Thu, 14 Apr 2016 19:49:22 GMT https://community.splunk.com/t5/Splunk-Search/how-to-sum-all-average-values-within-the-hour-and-timechart-only/m-p/205291#M59673 somesoni2 2016-04-14T19:49:22Z https://community.splunk.com/t5/Splunk-Search/how-to-sum-all-average-values-within-the-hour-and-timechart-only/m-p/205292#M59674 <P>that did it! thank you again!</P> Thu, 14 Apr 2016 19:52:03 GMT https://community.splunk.com/t5/Splunk-Search/how-to-sum-all-average-values-within-the-hour-and-timechart-only/m-p/205292#M59674 kamgineer 2016-04-14T19:52:03Z