Splunk Search

How do you sum values by day?

jyar1
Engager

Hi,

I'm new to Splunk and have written a simple search to see 4 trending values over a month.

auditSource XXX auditType XXX  "detail.serviceName"="XXX" | timechart count by detail.adminMessageType 

This gives me the values per day of 4 different admin message types e,g

              Message 1     Message 2     Message 3     Message 4
01/01/19           5                 10             4             7
02/01/19          15                 20            7             15
03/01/19           8                   3              6              16

When this converts to a line chart in visualizations, it shows me the value per day. I want it to report the total per message as the month goes on so you see the cumulative values. e.g

        Message 1     Message 2     Message 3     Message 4
01/01/19   5                 10       4             7
02/01/19   20                30          11            22
03/01/19   28                33             17          34

Can anyone help?

Cheers

0 Karma
1 Solution

renjith_nair
Legend

@jyar1,

Try this

 auditSource XXX auditType XXX "detail.serviceName"="XXX" | timechart count by detail.adminMessageType
|untable _time,detail.adminMessageType,count
|streamstats sum(count) as count |xyseries _time,detail.adminMessageType,count
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair
Legend

@jyar1,

Try this

 auditSource XXX auditType XXX "detail.serviceName"="XXX" | timechart count by detail.adminMessageType
|untable _time,detail.adminMessageType,count
|streamstats sum(count) as count |xyseries _time,detail.adminMessageType,count
---
What goes around comes around. If it helps, hit it with Karma 🙂

jyar1
Engager

Thankyou does exactly what i want - however is there a way for formatting the X Axis in the visualization to remove the timestamp and just show the date?

i.e - it shows | 2019-01-01 T00:00:00+00:00 | 2019-01-02 T00:00:00+00:00
Can it be formatted to show
2019-01-01 | 2019-01-02 | 2019-01-03

0 Karma

renjith_nair
Legend

yes, sure. Add below to the end of the search

eval _time=strftime(_time,"%Y-%m-%d")
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...