Splunk Search

Tstats sort and get top values

Communicator

Here is my search
| tstats sum(Accounting.Input) as Inp, sum(Accounting.Output) as out from datamodel="Accounting" by _time span=1h , Accounting.User_Name | eval tot=round((Inp+out)/100,2) | timechart span=1h sum(tot) as "Total" | sort -"Total" limit=500 by Accounting.User_Name

Definitely not working. But the intent is to list the total usage by top 500 users total (input + output) at any given time. I am going to combine this graph with one having overall total that is (input + output) of all users at any given point. That query is working (for reference)

| tstats sum(Accounting.Input) as Inp, sum(Accounting.Output) as out from datamodel="Accounting" by _time span=1h | eval tot=round((Inp+out)/100,2) | timechart span=1h sum(tot) as "Total Usage"

I need to combine these 2 queries to form a single graph to show usage by top 500 users and overall usage.

Tags (3)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Try this

| tstats sum(Accounting.Input) as Inp, sum(Accounting.Output) as out from datamodel="Accounting" by _time span=1h , Accounting.User_Name | eval tot=round((Inp+out)/100,2)  | sort -"Total" limit=500 by Accounting.User_Name | timechart span=1h sum(tot) as "Total"

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Try this

| tstats sum(Accounting.Input) as Inp, sum(Accounting.Output) as out from datamodel="Accounting" by _time span=1h , Accounting.User_Name | eval tot=round((Inp+out)/100,2)  | sort -"Total" limit=500 by Accounting.User_Name | timechart span=1h sum(tot) as "Total"

View solution in original post

0 Karma

Communicator

@somesoni2
Thank you... This query works !!
But.. it lists the top 500 "total" , maps it in the time range(x axis) when that value occurs. So I have just 500 values all together and the rest is null. I want the top 500 users overall. Lets say I select a time range of 7 days, I want the top 500 users for the 7 days and then I want to graph their usage for the 7 days. So the graph needs to be continuous.
Could you please help?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!