Splunk Enterprise

Add sum of two values to timeseries chart

_smp_
Builder

Hello, brand new Splunk user here getting my feet wet with the product, but I may be asking too much of myself at this point. We'll see.

I have a Windows forwarder sending messages to an Indexer on Linux. The forwarder is configured to send CPU stats, and the events are split between "% User TIme" and "% Processor Time". There is one event from each type sent every 10 seconds. I managed to create a timeseries chart with two lines - one line for % User TIme, and another line for % User time. Here is my search:

index=main source="Perfmon:CPU Load" | timechart max(Value) by counter

What I'd like to do now is add a third line representing the sum of these two values at a given point. So for example say at 10:00:00, I get an event with % User Time = 10 and % Processor Time = 20. At this point, I'd like a third line representing the sum of those two values (10 + 20 = 30), but overlaid on the same chart.

I have spent a few hours now reading the doc, Answers, and experimenting, but haven't come close. Seems like it should be pretty simple?

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

somesoni2
Revered Legend

What you need is "addtotals" command. See more details here.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/addtotals

_smp_
Builder

Yep, that was it. Just had to add an additional pipe to my search:

index=main source="Perfmon:CPU Load" | timechart max(Value) by counter | addtotals *Time Total row=t

Easy! Thanks so much!!!

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

New This Month - Observability Updates Give Extended Visibility and Improve User ...

This month is a collection of special news! From Magic Quadrant updates to AppDynamics integrations to ...

Intro to Splunk Synthetic Monitoring

In our last post, we mentioned that the 3 key pieces of observability – metrics, logs, and traces – provide ...