Add sum of two values to timeseries chart

[_smp_]

Hello, brand new Splunk user here getting my feet wet with the product, but I may be asking too much of myself at this point. We'll see.

I have a Windows forwarder sending messages to an Indexer on Linux. The forwarder is configured to send CPU stats, and the events are split between "% User TIme" and "% Processor Time". There is one event from each type sent every 10 seconds. I managed to create a timeseries chart with two lines - one line for % User TIme, and another line for % User time. Here is my search:

index=main source="Perfmon:CPU Load" | timechart max(Value) by counter

What I'd like to do now is add a third line representing the sum of these two values at a given point. So for example say at 10:00:00, I get an event with % User Time = 10 and % Processor Time = 20. At this point, I'd like a third line representing the sum of those two values (10 + 20 = 30), but overlaid on the same chart.

I have spent a few hours now reading the doc, Answers, and experimenting, but haven't come close. Seems like it should be pretty simple?

[somesoni2 · Accepted solution]

What you need is "addtotals" command. See more details here.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/addtotals

[_smp_]

Yep, that was it. Just had to add an additional pipe to my search:

index=main source="Perfmon:CPU Load" | timechart max(Value) by counter | addtotals *Time Total row=t

Easy! Thanks so much!!!