Trying to map total throughout the day

[aldrichb]

I have a search that gives me the total license usage in gb's for a given time:

index=_internal source=*license_usage.log type=Usage pool=* | stats sum(b) as bu | eval gbu=round(bu/1024/1024/1024,3) | fields gbu

I'd like to have a timechart/graph to show what the total is each hour of a given day. Is this possible to do with this timechart?

[bowesmana]

Sure you can, just use timechart, like this

index=_internal source=*license_usage.log type=Usage pool=* 
| timechart span=1h sum(b) as gbu 
| eval gbu=round(gbu/1024/1024/1024,3)

[aldrichb]

Thanks for this. The results of this don't seem to "Add up" every hour. I was hoping each hour the number would be greater, but it seems to be giving different numbers, if that makes sense.

[bowesmana · Accepted solution]

So you want your usage to show a cumulative value rather than the value for the specific hour?  If so, just add this to the end

| streamstats sum(gbu) as gbu

which will accumulate the hourly values and replace the hourly values with cumulative total.

If you want both values, then add this to the end instead of the above

| streamstats sum(gbu) as cum_gbu

 this will create a new field with the cumulative total

[bowesmana]

Note that with Splunk, there are often more ways to achieve the same goal. For example, you could use this instead of streamstats

| accum gbu

or

| accum gbu as cum_gbu

In the long run, streamstats is a more useful command (and takes more time to get your head around), as it supports split by clauses, whereas accum does not, so tends to be more useful.

[aldrichb]

Exactly what I was looking for. I haven't come across the streamstats term yet so this is great. Thank you!