Dashboards & Visualizations

display a daily total and 5 min charts of the same data

jhuysing
Explorer

I would  to have a graph so I can see the trend  for a period and have a overlay with the running total for the day
Colleague suggested this

 

index= ......
| timechart sum(values) span=5m by hosts limit=0
| addtotals

 

 But, it doesn't give the running total for day it give the total for the measurement period

Labels (2)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index ...
| timechart sum(values) span=5m limit=0 by hosts
| addtotals
| bin _time as day span=1d
| streamstats sum(Total) as running reset_on_change=true by day
| fields - day Total

PickleRick
SplunkTrust
SplunkTrust

Honestly, your requirements is a bit vague. How would that work? You want to have a timechart of 5-minute sums by host and additionally for each host a separate series repeating throughout the whole day the value of overall sum per host? That will not look well on the graph.

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...