Splunk Search

Sum session value from several servers?

mibo
New Member

Hi all,
I've been trying hard for two days now, but doesn't seem to find how to query to get the following graph:

I have three servers. All three have a performance counter called "Active SMTP Sessions" which returns the following field
"Active SMTP Sessions" = 23

I'd like a graph that shows the total amount of SMTP sessions, a sum of the same performance counter from all three servers.

I've managed to do a timechart showing the three values by host followed by the addtotal, and that's nice.
But I really only want the Total on my chart, not all thre servers plus total.

Any ideas?

Tags (2)
0 Karma

hexx
Splunk Employee
Splunk Employee

This doesn't do the trick?

... | timechart sum(active_SMTP_sessions) AS "Total active SMTP sessions"

Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...

Finding Based Detections General Availability

Overview  We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars  Sometimes, you just need to see the code. For those looking for a ...