Plottng a value (cumulative) over time.

[matthewceroni]

Hi:

I am feeding in Accounting data from my network equipment. This allows me to see what current active sessions I have (ie: how many users are logged into the network).

A simple search like this shows me the current active users:

index = accounting | dedup radacctid | search NOT acctstoptime = "*" | stats count

What I want to be able to do is plot this value over say the current day. The timechart function sort of works but what it is reporting is the relative number of users doing a time period. What I am looking for is the cumulative number. By that I mean, the above search runs for a time period of 9:00 am - 9:30 am and returns the number of users currently signed on. When it runs for the next time period, ending at 10:00 am (as an example) it returns the total number of users currently on the network (so almost essentially it ran the search with the new time period of 9:00 am - 10:00 am) and then repeat that for 30 minute intervals and graph.

Thanks

[jconger]

A possible solution would be to use a scheduled saved search that ran every 30 minutes and saved the count to a summary index. Check out the collect command http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Collect

Then, you can create a report or visualization based on the data in your summary index.