Splunk Search

Timecharting the sum() of min()/avg()/max()

jeffa
Path Finder

I'm sure there is an easy answer for this and I'm going feel silly when I see it. I have a scripted input that pulls volume data for several volumes every 5 minutes. I would like to see the change in used terabytes of the combined volumes over time (each volume has a used_tb key/value pair in the log). For short timeperiods, I can do...

... | timechart span=5m sum(used_tb)

but when once I need to go beyond the last 24 hours, this breaks down. I can do...

... | timechart span=1h min(used_tb) by volume

and then use an area graph in stacked mode to get the idea, but I can't get an accurate measure when I hover over the graph (the pop up is for the individual volumes).

I thought that nesting the functions...

... | timechart span=1h sum(min(used_tb) by volume)

would work, but this produces no values.

What really easy thing am I missing here?

Tags (5)
0 Karma
1 Solution

ziegfried
Influencer

This one should work:

... | bucket _time span=1h | stats min(used_tb) as min_used by volume,_time | timechart span=1h sum(min_used)

View solution in original post

ziegfried
Influencer

This one should work:

... | bucket _time span=1h | stats min(used_tb) as min_used by volume,_time | timechart span=1h sum(min_used)

jeffa
Path Finder

Brilliant! That did the trick.

0 Karma

ziegfried
Influencer

forgot to add time to the split-by clause of the stats. modified the search in the answer...

0 Karma

jeffa
Path Finder

That search still doesn't produce any charting results. I have played w/ bucketing and eval but no luck.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...