Splunk Search
Highlighted

Counting Events and then finding the sum?

Path Finder

Good Morning, Fellow Splunkers

I'm interested in counting events per hour for a 24 hr period. I would also like to have a sum total count for the end of the period. So within that hour how many alerts have been generated?

Time Alert
1h.............3
2h.............3
3h.............2
4h.............2
5h.............9
.
.
.
.
24h............(19) Sum

My search Query:
index=* host=* myalert=* |timechart span=1h count by host

0 Karma
Highlighted

Re: Counting Events and then finding the sum?

SplunkTrust
SplunkTrust

Something like this

index= host= myalert=* |timechart span=1h count by host | addcoltotals
Highlighted

Re: Counting Events and then finding the sum?

Communicator

Give this a shot, it will give you the counts per hour and an extra row to sum up the total of the day:

| tstats count WHERE index=_internal GROUPBY _time span=1h
| appendpipe [timechart span=24h sum(count) as total]
| sort _time

If you don't want to use tstats (which can be up to 1000x times faster than a regular search) you can do this:

index=_internal 
| timechart span=1h count
| appendpipe [timechart span=24h sum(count) as total]
| sort _time
0 Karma