Splunk Search

Timecharting the sum() of min()/avg()/max()

Path Finder

I'm sure there is an easy answer for this and I'm going feel silly when I see it. I have a scripted input that pulls volume data for several volumes every 5 minutes. I would like to see the change in used terabytes of the combined volumes over time (each volume has a used_tb key/value pair in the log). For short timeperiods, I can do...

... | timechart span=5m sum(used_tb)

but when once I need to go beyond the last 24 hours, this breaks down. I can do...

... | timechart span=1h min(used_tb) by volume

and then use an area graph in stacked mode to get the idea, but I can't get an accurate measure when I hover over the graph (the pop up is for the individual volumes).

I thought that nesting the functions...

... | timechart span=1h sum(min(used_tb) by volume)

would work, but this produces no values.

What really easy thing am I missing here?

Tags (5)
0 Karma
1 Solution

Influencer

This one should work:

... | bucket _time span=1h | stats min(used_tb) as min_used by volume,_time | timechart span=1h sum(min_used)

View solution in original post

Influencer

This one should work:

... | bucket _time span=1h | stats min(used_tb) as min_used by volume,_time | timechart span=1h sum(min_used)

View solution in original post

Path Finder

Brilliant! That did the trick.

0 Karma

Influencer

forgot to add time to the split-by clause of the stats. modified the search in the answer...

0 Karma

Path Finder

That search still doesn't produce any charting results. I have played w/ bucketing and eval but no luck.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!