Splunk Search

How to use accum with timechart?

Abass42
Path Finder

Hey, I had a quick question about my splunk search that doesnt work. Im using timechart and was wanting to display the single value visualization while having that sparkline. On some of these forum posts, i saw where they were using accum right after timechart, but my visualization just displays one of the values, im wanting it to accumulate while showing the sparkline. 

 

Abass42_0-1683831313396.png

 

 heres the code im using: 

 

 

index=ironport source="/export/var/splunk/ironport/mail/*"
| rex "((?<Domain>((@[a-zA-Z0-9._-]+\.[a-zA-Z0-9_-]+))))"  
| search Domain="@mail321.bluematrix.com"
| stats values(src_user) as src_user values(recipient) as recipient values(size) as msg_size values(_time) as _time values(eval(lower(Domain))) as Domain by MID
| eval Total_MB_Sent=msg_size/1024/1024
|table _time, Domain, Total_MB_Sent
| timechart span=1hr   sum(Total_MB_Sent) AS MSG_Sum by Domain
| accum MSG_Sum

 

 

 

I think its just updating the value shown, but it isnt accumulating. Any help would be appreciated. 

 

Labels (2)
0 Karma
1 Solution

yeahnah
Motivator

Hi @Abass42 

As soon as you use a group by clause in timechart the field headers become the group by result - in your case a domain name.  The accum would need to the domain field name as MSG_Sum does not exist due to the by clause grouping.

As the single value viz only shows the last value of the first column (other than _time) anyway, then there is no point having a domain group by.  So, this is what you would use... 

 

index=ironport source="/export/var/splunk/ironport/mail/*"
| rex "((?<Domain>((@[a-zA-Z0-9._-]+\.[a-zA-Z0-9_-]+))))"  
| search Domain="@mail321.bluematrix.com"
| stats values(src_user) as src_user values(recipient) as recipient values(size) as msg_size values(_time) as _time values(eval(lower(Domain))) as Domain by MID
| eval Total_MB_Sent=msg_size/1024/1024
|table _time, Domain, Total_MB_Sent
| timechart span=1hr   sum(Total_MB_Sent) AS MSG_Sum
| accum MSG_Sum

 

If you have different domains to display, then individually filter them before the timechart command, like this...

... your search ...
| table _time, Domain, Total_MB_Sent
| search Domain=<your domain>
| timechart span=1hr sum(Total_MB_Sent) AS MSG_Sum
| accum MSG_Sum

 Or if you no the domain name then you can use accum <domain>, instead when using the group by clause.

Hope that makes sense and helps

View solution in original post

yeahnah
Motivator

Hi @Abass42 

As soon as you use a group by clause in timechart the field headers become the group by result - in your case a domain name.  The accum would need to the domain field name as MSG_Sum does not exist due to the by clause grouping.

As the single value viz only shows the last value of the first column (other than _time) anyway, then there is no point having a domain group by.  So, this is what you would use... 

 

index=ironport source="/export/var/splunk/ironport/mail/*"
| rex "((?<Domain>((@[a-zA-Z0-9._-]+\.[a-zA-Z0-9_-]+))))"  
| search Domain="@mail321.bluematrix.com"
| stats values(src_user) as src_user values(recipient) as recipient values(size) as msg_size values(_time) as _time values(eval(lower(Domain))) as Domain by MID
| eval Total_MB_Sent=msg_size/1024/1024
|table _time, Domain, Total_MB_Sent
| timechart span=1hr   sum(Total_MB_Sent) AS MSG_Sum
| accum MSG_Sum

 

If you have different domains to display, then individually filter them before the timechart command, like this...

... your search ...
| table _time, Domain, Total_MB_Sent
| search Domain=<your domain>
| timechart span=1hr sum(Total_MB_Sent) AS MSG_Sum
| accum MSG_Sum

 Or if you no the domain name then you can use accum <domain>, instead when using the group by clause.

Hope that makes sense and helps

Abass42
Path Finder

Wow. I tried multiple variations of that query, and one of them at some point i thought was what you suggested, but apparently not. Your query worked like a charm. Thank you. I appreciate your help. 🤝

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...