Splunk Search

How do you sum values by day?

jyar1
Engager

Hi,

I'm new to Splunk and have written a simple search to see 4 trending values over a month.

auditSource XXX auditType XXX  "detail.serviceName"="XXX" | timechart count by detail.adminMessageType 

This gives me the values per day of 4 different admin message types e,g

              Message 1     Message 2     Message 3     Message 4
01/01/19           5                 10             4             7
02/01/19          15                 20            7             15
03/01/19           8                   3              6              16

When this converts to a line chart in visualizations, it shows me the value per day. I want it to report the total per message as the month goes on so you see the cumulative values. e.g

        Message 1     Message 2     Message 3     Message 4
01/01/19   5                 10       4             7
02/01/19   20                30          11            22
03/01/19   28                33             17          34

Can anyone help?

Cheers

0 Karma
1 Solution

renjith_nair
Legend

@jyar1,

Try this

 auditSource XXX auditType XXX "detail.serviceName"="XXX" | timechart count by detail.adminMessageType
|untable _time,detail.adminMessageType,count
|streamstats sum(count) as count |xyseries _time,detail.adminMessageType,count
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair
Legend

@jyar1,

Try this

 auditSource XXX auditType XXX "detail.serviceName"="XXX" | timechart count by detail.adminMessageType
|untable _time,detail.adminMessageType,count
|streamstats sum(count) as count |xyseries _time,detail.adminMessageType,count
---
What goes around comes around. If it helps, hit it with Karma 🙂

jyar1
Engager

Thankyou does exactly what i want - however is there a way for formatting the X Axis in the visualization to remove the timestamp and just show the date?

i.e - it shows | 2019-01-01 T00:00:00+00:00 | 2019-01-02 T00:00:00+00:00
Can it be formatted to show
2019-01-01 | 2019-01-02 | 2019-01-03

0 Karma

renjith_nair
Legend

yes, sure. Add below to the end of the search

eval _time=strftime(_time,"%Y-%m-%d")
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...