Splunk Search

How to use accum with timechart?

Abass42
Path Finder

Hey, I had a quick question about my splunk search that doesnt work. Im using timechart and was wanting to display the single value visualization while having that sparkline. On some of these forum posts, i saw where they were using accum right after timechart, but my visualization just displays one of the values, im wanting it to accumulate while showing the sparkline. 

 

Abass42_0-1683831313396.png

 

 heres the code im using: 

 

 

index=ironport source="/export/var/splunk/ironport/mail/*"
| rex "((?<Domain>((@[a-zA-Z0-9._-]+\.[a-zA-Z0-9_-]+))))"  
| search Domain="@mail321.bluematrix.com"
| stats values(src_user) as src_user values(recipient) as recipient values(size) as msg_size values(_time) as _time values(eval(lower(Domain))) as Domain by MID
| eval Total_MB_Sent=msg_size/1024/1024
|table _time, Domain, Total_MB_Sent
| timechart span=1hr   sum(Total_MB_Sent) AS MSG_Sum by Domain
| accum MSG_Sum

 

 

 

I think its just updating the value shown, but it isnt accumulating. Any help would be appreciated. 

 

Labels (2)
0 Karma
1 Solution

yeahnah
Motivator

Hi @Abass42 

As soon as you use a group by clause in timechart the field headers become the group by result - in your case a domain name.  The accum would need to the domain field name as MSG_Sum does not exist due to the by clause grouping.

As the single value viz only shows the last value of the first column (other than _time) anyway, then there is no point having a domain group by.  So, this is what you would use... 

 

index=ironport source="/export/var/splunk/ironport/mail/*"
| rex "((?<Domain>((@[a-zA-Z0-9._-]+\.[a-zA-Z0-9_-]+))))"  
| search Domain="@mail321.bluematrix.com"
| stats values(src_user) as src_user values(recipient) as recipient values(size) as msg_size values(_time) as _time values(eval(lower(Domain))) as Domain by MID
| eval Total_MB_Sent=msg_size/1024/1024
|table _time, Domain, Total_MB_Sent
| timechart span=1hr   sum(Total_MB_Sent) AS MSG_Sum
| accum MSG_Sum

 

If you have different domains to display, then individually filter them before the timechart command, like this...

... your search ...
| table _time, Domain, Total_MB_Sent
| search Domain=<your domain>
| timechart span=1hr sum(Total_MB_Sent) AS MSG_Sum
| accum MSG_Sum

 Or if you no the domain name then you can use accum <domain>, instead when using the group by clause.

Hope that makes sense and helps

View solution in original post

yeahnah
Motivator

Hi @Abass42 

As soon as you use a group by clause in timechart the field headers become the group by result - in your case a domain name.  The accum would need to the domain field name as MSG_Sum does not exist due to the by clause grouping.

As the single value viz only shows the last value of the first column (other than _time) anyway, then there is no point having a domain group by.  So, this is what you would use... 

 

index=ironport source="/export/var/splunk/ironport/mail/*"
| rex "((?<Domain>((@[a-zA-Z0-9._-]+\.[a-zA-Z0-9_-]+))))"  
| search Domain="@mail321.bluematrix.com"
| stats values(src_user) as src_user values(recipient) as recipient values(size) as msg_size values(_time) as _time values(eval(lower(Domain))) as Domain by MID
| eval Total_MB_Sent=msg_size/1024/1024
|table _time, Domain, Total_MB_Sent
| timechart span=1hr   sum(Total_MB_Sent) AS MSG_Sum
| accum MSG_Sum

 

If you have different domains to display, then individually filter them before the timechart command, like this...

... your search ...
| table _time, Domain, Total_MB_Sent
| search Domain=<your domain>
| timechart span=1hr sum(Total_MB_Sent) AS MSG_Sum
| accum MSG_Sum

 Or if you no the domain name then you can use accum <domain>, instead when using the group by clause.

Hope that makes sense and helps

Abass42
Path Finder

Wow. I tried multiple variations of that query, and one of them at some point i thought was what you suggested, but apparently not. Your query worked like a charm. Thank you. I appreciate your help. 🤝

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...