Splunk Search

How can i calculate sum of values from different hosts

mishaaaaaaaaaa
Explorer

Hi, splunkers!
I have 4 hosts, and i need to culculate total sum of values contained in each event
In other words i have:
host1: value1
host2: value2
host3: value3
host4: value4
and i need to calculate value1+value2+value3+value4 and display it in Single Value splunk visualisation
i try to do it like this:
index=myIndex host=host1 OR host=host2 OR host=host3 OR host=host4
| timechart max(value) by host as "Total Max Value"

but i have max value from all hosts displayed

Tags (1)
0 Karma

chrisyounger
SplunkTrust
SplunkTrust

hi @mishaaaaaaaaaa

Try this index=myIndex host=host1 OR host=host2 OR host=host3 OR host=host4| stats sum(value) as "Total Max Value"

Good luck!

0 Karma

mishaaaaaaaaaa
Explorer

i tryed to do it like you suggested, but in this case i have sum of values by all period
and i need value by the current moment

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Can you just change the timepicker to be "last 15 minutes"? Does that do what you want?

0 Karma

mishaaaaaaaaaa
Explorer

I need to see statistic by 2 hour but display only current value at the moment but not a sum of values since the system have been started

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

ok I understand now. Try this index=myIndex host=host1 OR host=host2 OR host=host3 OR host=host4| stats latest(value) as "Latest Value"

0 Karma

mishaaaaaaaaaa
Explorer

No, this doesn't work
i found something like this, but it also works bad

index=myIndex | bucket _time span=2h | stats max($module$.metric.sampleCount) as metricValueFromAllHosts by host, _time | timechart span=2h sum(metricValueFromAllHosts)

this solution correctly display the sum of metric.sampleCount from all hasts, but doesn't display statistic like if i had metric.sampleCount=16 two hours ago and now i have 32, it shows 0 always

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

OK last try. What about index=myIndex host=host1 OR host=host2 OR host=host3 OR host=host4| stats latest(value) as latest by host | stats sum(latest)

0 Karma

mishaaaaaaaaaa
Explorer

No, this doesn't work too
Your solution calculates only sum of metrics from all hosts at the current moment and dysplay them
But i need sum of metrics from all hosts at the current moment and statistic like from earliest bound of period till latest bound of period we have increase sum of metrics on 16 for example, so in the earliest bound we had 12 and in latest we have 28
And single value visualisation allows us to display such statistic

0 Karma

vishaltaneja070
Motivator

@mishaaaaaaaaaa

Try something like this:

    index=myIndex host=host1 OR host=host2 OR host=host3 OR host=host4| stats sum(value) as latest by host | stats sum(latest)
0 Karma

mishaaaaaaaaaa
Explorer

Thanks a lot for everyone for your answers, the problem was because my metric accumulates to previous values.
In my case this solution works correct:
index=someIndex | bucket _time | stats max(metric.sampleCount) as metricValueFromAllHosts by host, _time | timechart sum(metricValueFromAllHosts)

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...