Splunk Search
Highlighted

Subtotals over columns generated by timechart

Explorer

I have the following search query:

source=*Src some_filtering | ... | timechart span=5m max(ActCnt) by source

that produces results like:

time c:\log1 c:\log2 c:\log3 c:\file1 c:\file2
2014-07-03 00:00:00 2
2014-07-03 00:05:00 2 4 2 4
2014-07-03 00:10:00 1 6 2 2 2
2014-07-03 00:15:00 1
2014-07-03 00:20:00 1

My goal is to get the subtotals by columns from sources log* and file*.
As result I would need just something like this:
time LOG FILE
2014-07-03 00:00:00 2
2014-07-03 00:05:00 8 4
2014-07-03 00:10:00 9 4
2014-07-03 00:15:00 1
2014-07-03 00:20:00 1

I tried to summarize columns after timechart command using | addcoltotals and | foreach but looks like addressing auto-generated fields (that match to my log source names) isn't possible after timechart.
I cannot use sum over ActCnt field, because that would also summarize values that appear in one log (e.g. c:\log1). My goal is to get subtotals over different logs.

Thanks in advance.

Tags (2)
0 Karma
Highlighted

Re: Subtotals over columns generated by timechart

SplunkTrust
SplunkTrust

Try something like this (assuming 'LOG' represent sources with string "log" in the name and 'FILE' represents sources with string "file" in the name)

source=*Src some_filtering | ... | timechart span=5m max(ActCnt) by source | addtotals fieldname=LOG *log* |  addtotals fieldname=FILE *file* | table _time LOG FILE

View solution in original post

Highlighted

Re: Subtotals over columns generated by timechart

Explorer

Thank you. It does display some subtotals. However, after comparison total numbers with not aggregated results I see differences. Will dig into that.

0 Karma
Highlighted

Re: Subtotals over columns generated by timechart

Explorer

Actually, found a mistake in my query. Now all results are CORRECT! Marking the answer as accepted.

0 Karma