Splunk Search

Sum session value from several servers?

mibo
New Member

Hi all,
I've been trying hard for two days now, but doesn't seem to find how to query to get the following graph:

I have three servers. All three have a performance counter called "Active SMTP Sessions" which returns the following field
"Active SMTP Sessions" = 23

I'd like a graph that shows the total amount of SMTP sessions, a sum of the same performance counter from all three servers.

I've managed to do a timechart showing the three values by host followed by the addtotal, and that's nice.
But I really only want the Total on my chart, not all thre servers plus total.

Any ideas?

Tags (2)
0 Karma

hexx
Splunk Employee
Splunk Employee

This doesn't do the trick?

... | timechart sum(active_SMTP_sessions) AS "Total active SMTP sessions"

Get Updates on the Splunk Community!

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

 Prepare to elevate your security operations with the powerful upgrade to Splunk Enterprise Security 8.x! This ...

Get Early Access to AI Playbook Authoring: Apply for the Alpha Private Preview ...

Passionate about security automation? Apply now to our AI Playbook Authoring Alpha private preview ...

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...