Splunk Search

Subtotals over columns generated by timechart

takemusu
Explorer

I have the following search query:

source=*Src some_filtering | ... | timechart span=5m max(ActCnt) by source

that produces results like:

time c:\log1 c:\log2 c:\log3 c:\file1 c:\file2
2014-07-03 00:00:00 2
2014-07-03 00:05:00 2 4 2 4
2014-07-03 00:10:00 1 6 2 2 2
2014-07-03 00:15:00 1
2014-07-03 00:20:00 1

My goal is to get the subtotals by columns from sources log* and file*.
As result I would need just something like this:
time LOG FILE
2014-07-03 00:00:00 2
2014-07-03 00:05:00 8 4
2014-07-03 00:10:00 9 4
2014-07-03 00:15:00 1
2014-07-03 00:20:00 1

I tried to summarize columns after timechart command using | addcoltotals and | foreach but looks like addressing auto-generated fields (that match to my log source names) isn't possible after timechart.
I cannot use sum over ActCnt field, because that would also summarize values that appear in one log (e.g. c:\log1). My goal is to get subtotals over different logs.

Thanks in advance.

Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

Try something like this (assuming 'LOG' represent sources with string "log" in the name and 'FILE' represents sources with string "file" in the name)

source=*Src some_filtering | ... | timechart span=5m max(ActCnt) by source | addtotals fieldname=LOG *log* |  addtotals fieldname=FILE *file* | table _time LOG FILE

View solution in original post

somesoni2
Revered Legend

Try something like this (assuming 'LOG' represent sources with string "log" in the name and 'FILE' represents sources with string "file" in the name)

source=*Src some_filtering | ... | timechart span=5m max(ActCnt) by source | addtotals fieldname=LOG *log* |  addtotals fieldname=FILE *file* | table _time LOG FILE

takemusu
Explorer

Actually, found a mistake in my query. Now all results are CORRECT! Marking the answer as accepted.

0 Karma

takemusu
Explorer

Thank you. It does display some subtotals. However, after comparison total numbers with not aggregated results I see differences. Will dig into that.

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...