Splunk Search

How do you sum values by day?

jyar1
Engager

Hi,

I'm new to Splunk and have written a simple search to see 4 trending values over a month.

auditSource XXX auditType XXX  "detail.serviceName"="XXX" | timechart count by detail.adminMessageType 

This gives me the values per day of 4 different admin message types e,g

              Message 1     Message 2     Message 3     Message 4
01/01/19           5                 10             4             7
02/01/19          15                 20            7             15
03/01/19           8                   3              6              16

When this converts to a line chart in visualizations, it shows me the value per day. I want it to report the total per message as the month goes on so you see the cumulative values. e.g

        Message 1     Message 2     Message 3     Message 4
01/01/19   5                 10       4             7
02/01/19   20                30          11            22
03/01/19   28                33             17          34

Can anyone help?

Cheers

0 Karma
1 Solution

renjith_nair
Legend

@jyar1,

Try this

 auditSource XXX auditType XXX "detail.serviceName"="XXX" | timechart count by detail.adminMessageType
|untable _time,detail.adminMessageType,count
|streamstats sum(count) as count |xyseries _time,detail.adminMessageType,count
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair
Legend

@jyar1,

Try this

 auditSource XXX auditType XXX "detail.serviceName"="XXX" | timechart count by detail.adminMessageType
|untable _time,detail.adminMessageType,count
|streamstats sum(count) as count |xyseries _time,detail.adminMessageType,count
---
What goes around comes around. If it helps, hit it with Karma 🙂

jyar1
Engager

Thankyou does exactly what i want - however is there a way for formatting the X Axis in the visualization to remove the timestamp and just show the date?

i.e - it shows | 2019-01-01 T00:00:00+00:00 | 2019-01-02 T00:00:00+00:00
Can it be formatted to show
2019-01-01 | 2019-01-02 | 2019-01-03

0 Karma

renjith_nair
Legend

yes, sure. Add below to the end of the search

eval _time=strftime(_time,"%Y-%m-%d")
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...