Splunk Search

Accum timeseries and grouping

Oren
Explorer

From our weblogs, I have extracted fields including http_bytes and http_domain. I would like to get a stacked chart of bandwidth consumed (accum http_bytes) by http_domain. My naive attempts have ended comically.

Related, I'd like to see for a given http_domain, I'm looking for two queries: how much bandwidth it used both for the search period, and a timechart for just that app.

Tags (2)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

I think it should just be:

sourcetype=myweblogs | chart sum(http_bytes) by http_domain

and

sourcetype=myweblogs http_domain="my_domain" | stats sum(http_bytes)
sourcetype=myweblogs http_domain="my_domain" | timechart span=5min sum(http_bytes)

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

I think it should just be:

sourcetype=myweblogs | chart sum(http_bytes) by http_domain

and

sourcetype=myweblogs http_domain="my_domain" | stats sum(http_bytes)
sourcetype=myweblogs http_domain="my_domain" | timechart span=5min sum(http_bytes)

Oren
Explorer

ah, thanks! I was mentally stuck on accum, which is clearly the wrong tool here.

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...