Splunk Search

Accum timeseries and grouping

Oren
Explorer

From our weblogs, I have extracted fields including http_bytes and http_domain. I would like to get a stacked chart of bandwidth consumed (accum http_bytes) by http_domain. My naive attempts have ended comically.

Related, I'd like to see for a given http_domain, I'm looking for two queries: how much bandwidth it used both for the search period, and a timechart for just that app.

Tags (2)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

I think it should just be:

sourcetype=myweblogs | chart sum(http_bytes) by http_domain

and

sourcetype=myweblogs http_domain="my_domain" | stats sum(http_bytes)
sourcetype=myweblogs http_domain="my_domain" | timechart span=5min sum(http_bytes)

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

I think it should just be:

sourcetype=myweblogs | chart sum(http_bytes) by http_domain

and

sourcetype=myweblogs http_domain="my_domain" | stats sum(http_bytes)
sourcetype=myweblogs http_domain="my_domain" | timechart span=5min sum(http_bytes)

Oren
Explorer

ah, thanks! I was mentally stuck on accum, which is clearly the wrong tool here.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...