Splunk Search

Timechart all values and one specific

alex_kh
Explorer

Hey guys and girls,
I am trying to create a diagram witth follwing input:

I have two queries

search index= blabla host = | timechart sum(bytes)
search index=blabla host="youtube"| timechart sum (bytes)*

for both of the searches i get a wonderfull timechart.
My issue is to combine them in a one time chart

Y -Axis amout of bytes
X- Time

and two bars: all hosts and a specific (youtube).

I tried append/ appendcols
I tried index...| where host= OR host =youtube | timechart...*

Did not work

0 Karma
1 Solution

diogofgm
SplunkTrust
SplunkTrust

Hi,
Try this:

index=blabla 
| eval group=if(host="youtube",host,"others")
| timechart sum(bytes) by group
------------
Hope I was able to help you. If so, some karma would be appreciated.

View solution in original post

diogofgm
SplunkTrust
SplunkTrust

Hi,
Try this:

index=blabla 
| eval group=if(host="youtube",host,"others")
| timechart sum(bytes) by group
------------
Hope I was able to help you. If so, some karma would be appreciated.

adonio
Ultra Champion

maybe:
index = blabla host=YouTube OR host="other_host" OR host="another_host" OR .... | timechart sum(bytes) as total_bytes by host

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>