How do you sum values by day?

[jyar1]

Hi,

I'm new to Splunk and have written a simple search to see 4 trending values over a month.

auditSource XXX auditType XXX  "detail.serviceName"="XXX" | timechart count by detail.adminMessageType 

This gives me the values per day of 4 different admin message types e,g

              Message 1     Message 2     Message 3     Message 4
01/01/19           5                 10             4             7
02/01/19          15                 20            7             15
03/01/19           8                   3              6              16

When this converts to a line chart in visualizations, it shows me the value per day. I want it to report the total per message as the month goes on so you see the cumulative values. e.g

        Message 1     Message 2     Message 3     Message 4
01/01/19   5                 10       4             7
02/01/19   20                30          11            22
03/01/19   28                33             17          34

Can anyone help?

Cheers

[renjith_nair · Accepted solution]

@jyar1,

Try this

 auditSource XXX auditType XXX "detail.serviceName"="XXX" | timechart count by detail.adminMessageType
|untable _time,detail.adminMessageType,count
|streamstats sum(count) as count |xyseries _time,detail.adminMessageType,count

[jyar1]

Thankyou does exactly what i want - however is there a way for formatting the X Axis in the visualization to remove the timestamp and just show the date?

i.e - it shows | 2019-01-01 T00:00:00+00:00 | 2019-01-02 T00:00:00+00:00
Can it be formatted to show
2019-01-01 | 2019-01-02 | 2019-01-03

[renjith_nair]

yes, sure. Add below to the end of the search

eval _time=strftime(_time,"%Y-%m-%d")