How to add in timechart on an addcoltotals search

[eb1929]

Hello I am running the following search, which works as it should. What I am trying to build off of it is a way to add a timechart to the search to see daily usage over 2 weeks. 

| `kva_tstats_switcher("tstats sum(RootObject.bc) as total_bytes from datamodel=indexed_event_counts_hourly where [| tstats count where index=* source=/p01/data/syslogs* by sourcetype
| fields - count
| rename sourcetype as RootObject.st| return 1000 RootObject.st] by RootObject.st")`
| rename RootObject.* as *
| sort 100 - total_bytes
| eval total_bytes=round(total_bytes/1073741824,1)
| rename total_bytes as total_gb
| rename st as sourcetype
| addcoltotals labelfield=Total label=Total_Sum
| sort – Total

[Richfez · Accepted solution]

You seem to want one search to do two quite different jobs.  I think we can still make it work though.

You don't have time in your search, so there's no way to have time in your results unless you include it there, so in order to do that, umm, we do that.  Was that sentence even English?  Do I even logic?  Lol.

So your subsearch returns a root object ... thing... back into the main search, which is itself a tstats based search run from a macro.  Sorry, thinking out loud.  But this does make it really messy to try to fix it without being intimately familiar with the data.  I'd suggest possibly next time, at least ctrl-e expand those macros before pasting it in, because they're load bearing in this case.  But anyway no worries.

So .. first guess.

| `kva_tstats_switcher("tstats sum(RootObject.bc) as total_bytes from datamodel=indexed_event_counts_hourly where 
  [ | tstats count where index=* source=/p01/data/syslogs* by sourcetype
    | fields - count
    | rename sourcetype as RootObject.st 
    | return 1000 RootObject.st] 
  by RootObject.st, _time span=1d")` 
| rename RootObject.* as *
| timechart span=1d sum(total_bytes) as total_bytes

I don't have sample data, sample output,  or any other indications of what all the rest of your search is doing, so from there you might have to rebuild a few pieces, but that should be the start of it.  If you get into specific problems in "finishing" that, post back!

Happy Splunking,

Rich

[eb1929]

Thank you so much for that, I had been spinning my head for 2 days on that.... MUCH APPRECIATED!!!