Knowledge Management

Graphing or bucketing a summary indexed query


I've setup a summary index that works great. I usually use it like this:

index=summary search_name="Z - Top Domain - 15 minutes" | top 50 http_domain 

When I run this query, it gives me three fields - the http_domain, the "count" which is the # of hits of that domain, and the percent of total. I'd like to graph the sum(count) by http_domain. I naively tried this, and of course failed hard. Attempts to use bucket have met with blank stares from the search engine as well.

It's clear the data is in there - if I run the query for 1 hour, I get 1 hour of results. Ideally then I could bucket the results each hour or equivalent.

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

How are you populating the summary index? If you're using "... | sitop http_domain" then the "... | top" is really the only valid thing you can do.

On the other hand, if you store the summary manually, say "... | stats count by http_domain", then you should be able to compute "... | timechart sum(count) by http_domain".

Calculating "... | top 50 http_domain" is a bit harder, say "... | stats sum(count) as count by http_domain | sort - count | head 50" and is even harder if you want percents, where you'll have to add "... | eventstats sum(count) as sum_count | eval percent = count / sum_count | fields - sum_count | ..." between the stats and the sort.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!