How to find spike in total count of a field?

[jwalzerpitt]

I'd like to be able to search for the following:

1) timechart over X days for the sum of the count of a field
2) spikes or % increase for the sum of the count of a field compared to previous hour, day, week, etc

For example, we are ingesting Palo logs and I'd like to be able to see what fields have the highest sum/total for the time period I run and then also see the % increase/decrease of the sum/total for the field as well compared to an hour/day/week/etc.

Not looking to break the count of the field using 'BY', but just interested in the sum/total of all events for a field

Thx

[codebuilder]

Pipe the results of your query to "fieldsummary", which by default provides both "count" and "distinct_count".
I think this will get you the data you're after, based on your question.

See this documentation for more detailed explanation:
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Fieldsummary