Splunk Search

How to add in timechart on an addcoltotals search

eb1929
Explorer

Hello I am running the following search, which works as it should. What I am trying to build off of it is a way to add a timechart to the search to see daily usage over 2 weeks. 

 

| `kva_tstats_switcher("tstats sum(RootObject.bc) as total_bytes from datamodel=indexed_event_counts_hourly where [| tstats count where index=* source=/p01/data/syslogs* by sourcetype
| fields - count
| rename sourcetype as RootObject.st| return 1000 RootObject.st] by RootObject.st")`
| rename RootObject.* as *
| sort 100 - total_bytes
| eval total_bytes=round(total_bytes/1073741824,1)
| rename total_bytes as total_gb
| rename st as sourcetype
| addcoltotals labelfield=Total label=Total_Sum
| sort – Total

0 Karma
1 Solution

Richfez
SplunkTrust
SplunkTrust

You seem to want one search to do two quite different jobs.  I think we can still make it work though.

You don't have time in your search, so there's no way to have time in your results unless you include it there, so in order to do that, umm, we do that.  Was that sentence even English?  Do I even logic?  Lol.

So your subsearch returns a root object ... thing... back into the main search, which is itself a tstats based search run from a macro.  Sorry, thinking out loud.  But this does make it really messy to try to fix it without being intimately familiar with the data.  I'd suggest possibly next time, at least ctrl-e expand those macros before pasting it in, because they're load bearing in this case.  But anyway no worries.

So .. first guess.

| `kva_tstats_switcher("tstats sum(RootObject.bc) as total_bytes from datamodel=indexed_event_counts_hourly where 
  [ | tstats count where index=* source=/p01/data/syslogs* by sourcetype
    | fields - count
    | rename sourcetype as RootObject.st 
    | return 1000 RootObject.st] 
  by RootObject.st, _time span=1d")` 
| rename RootObject.* as *
| timechart span=1d sum(total_bytes) as total_bytes

 

I don't have sample data, sample output,  or any other indications of what all the rest of your search is doing, so from there you might have to rebuild a few pieces, but that should be the start of it.  If you get into specific problems in "finishing" that, post back!

 

Happy Splunking,

Rich

View solution in original post

Richfez
SplunkTrust
SplunkTrust

You seem to want one search to do two quite different jobs.  I think we can still make it work though.

You don't have time in your search, so there's no way to have time in your results unless you include it there, so in order to do that, umm, we do that.  Was that sentence even English?  Do I even logic?  Lol.

So your subsearch returns a root object ... thing... back into the main search, which is itself a tstats based search run from a macro.  Sorry, thinking out loud.  But this does make it really messy to try to fix it without being intimately familiar with the data.  I'd suggest possibly next time, at least ctrl-e expand those macros before pasting it in, because they're load bearing in this case.  But anyway no worries.

So .. first guess.

| `kva_tstats_switcher("tstats sum(RootObject.bc) as total_bytes from datamodel=indexed_event_counts_hourly where 
  [ | tstats count where index=* source=/p01/data/syslogs* by sourcetype
    | fields - count
    | rename sourcetype as RootObject.st 
    | return 1000 RootObject.st] 
  by RootObject.st, _time span=1d")` 
| rename RootObject.* as *
| timechart span=1d sum(total_bytes) as total_bytes

 

I don't have sample data, sample output,  or any other indications of what all the rest of your search is doing, so from there you might have to rebuild a few pieces, but that should be the start of it.  If you get into specific problems in "finishing" that, post back!

 

Happy Splunking,

Rich

eb1929
Explorer

Thank you so much for that, I had been spinning my head for 2 days on that.... MUCH APPRECIATED!!!  

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...