Splunk Search

Accum timeseries and grouping

Oren
Explorer

From our weblogs, I have extracted fields including http_bytes and http_domain. I would like to get a stacked chart of bandwidth consumed (accum http_bytes) by http_domain. My naive attempts have ended comically.

Related, I'd like to see for a given http_domain, I'm looking for two queries: how much bandwidth it used both for the search period, and a timechart for just that app.

Tags (2)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

I think it should just be:

sourcetype=myweblogs | chart sum(http_bytes) by http_domain

and

sourcetype=myweblogs http_domain="my_domain" | stats sum(http_bytes)
sourcetype=myweblogs http_domain="my_domain" | timechart span=5min sum(http_bytes)

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

I think it should just be:

sourcetype=myweblogs | chart sum(http_bytes) by http_domain

and

sourcetype=myweblogs http_domain="my_domain" | stats sum(http_bytes)
sourcetype=myweblogs http_domain="my_domain" | timechart span=5min sum(http_bytes)

Oren
Explorer

ah, thanks! I was mentally stuck on accum, which is clearly the wrong tool here.

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...