Splunk Search

## Sum value from distinct hosts over time

Path Finder

I have a bunch of hosts streaming logs that show metrics like cpu count. The problem is that they all send those logs at different times. I'm trying to calculate perform math on the aggregate metrics, but everything is wrong because I can't figure out how to perform math on the values from distinct hosts. I've searched for deduping on a span and got nowhere. Logs look something like this:

1:00:01 - ip=192.168.1.5 cpu_count=8
1:00:01 - ip=192.168.1.6 cpu_count=8
1:00:02 - ip=192.168.1.7 cpu_count=8
1:00:03 - ip=192.168.1.8 cpu_count=8
1:00:03 - ip=192.168.1.7 cpu_count=8
1:00:03 - ip=192.168.1.5 cpu_count=8
1:00:03 - ip=192.168.1.6 cpu_count=8
1:00:04 - ip=192.168.1.7 cpu_count=8
1:00:04 - ip=192.168.1.8 cpu_count=8

what i want to do is something like | dedup span=1m by ip | eval TotalPercent = cpu_count * 100 | timechart sum(TotalPercent) AS TotalAvailableCPUPercent

hope that makes sense

Tags (1)
1 Solution
Legend

You probably want `bucket` for grouping your events by time and deduping on that.

``````... | bucket _time span=1m | dedup _time ip | eval TotalPercent = cpu_count * 100 | chart sum(TotalPercent) AS TotalAvailableCPUPercent over _time
``````
Legend

You probably want `bucket` for grouping your events by time and deduping on that.

``````... | bucket _time span=1m | dedup _time ip | eval TotalPercent = cpu_count * 100 | chart sum(TotalPercent) AS TotalAvailableCPUPercent over _time
``````
Get Updates on the Splunk Community!

#### Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...

#### There's No Place Like Chrome and the Splunk Platform

WATCH NOW!Malware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...