Splunk Search
Highlighted

How to change my stats sum(x) search to an hourly timechart sum(y)?

Builder

Hi

I have the following search which displays the sum of a field, but I am trying to put a time chart in hourly which shows the sum of that particular hour.

…..My Search……| rex "value(?<amount>\d+.\d+)" | stats count by amount |stats sum(amount) as total

How to modify my search to display the hourly count?

Any help or Suggestions?

0 Karma
Highlighted

Re: How to change my stats sum(x) search to an hourly timechart sum(y)?

Influencer

Try something like:

…..My Search……| rex "value(?<amount>d+.d+)" | bin _time span=1h | timechart sum(amount) as total span=1h

or

…..My Search……| rex "value(?<amount>d+.d+)" | bin _time span=1h | stats count by amount, _time | timechart sum(amount) as total span=1h
0 Karma
Highlighted

Re: How to change my stats sum(x) search to an hourly timechart sum(y)?

Splunk Employee
Splunk Employee

I think you just want something like:

... | rex "value(?<amount>d+.d+)" | timechart span=1h sum(amount) AS "Hourly amount"

Alternatively, you could also use per_hour():

... | rex "value(?<amount>d+.d+)" | timechart span=1h per_hour(amount) AS "Hourly amount"

Both of these searches should return one result per hour reflecting the sum of the values of the "amount" field for all events within a particular hour.

View solution in original post

Highlighted

Re: How to change my stats sum(x) search to an hourly timechart sum(y)?

Splunk Employee
Splunk Employee

index=_internal | timechart span=1h sum(count)

in your case :
…..My Search……| rex "value(?d+.d+)" | timechart span=1h sum(amount)

0 Karma
Highlighted

Re: How to change my stats sum(x) search to an hourly timechart sum(y)?

SplunkTrust
SplunkTrust

Based on your search, it looks like you're extracting field amount, finding unique values of the field amount (first stats) and then getting total of unique amount values. If this is correct and you want to get total of unique amount values based on the hour, try this

 …..My Search……| rex "value(?<amount>\d+.\d+)" | bucket span=1h _time | stats count by _time, amount |stats sum(amount) as total by
0 Karma