Splunk Search

Tstats sort and get top values

Communicator

Here is my search
| tstats sum(Accounting.Input) as Inp, sum(Accounting.Output) as out from datamodel="Accounting" by time span=1h , Accounting.UserName | eval tot=round((Inp+out)/100,2) | timechart span=1h sum(tot) as "Total" | sort -"Total" limit=500 by Accounting.User_Name

Definitely not working. But the intent is to list the total usage by top 500 users total (input + output) at any given time. I am going to combine this graph with one having overall total that is (input + output) of all users at any given point. That query is working (for reference)

| tstats sum(Accounting.Input) as Inp, sum(Accounting.Output) as out from datamodel="Accounting" by _time span=1h | eval tot=round((Inp+out)/100,2) | timechart span=1h sum(tot) as "Total Usage"

I need to combine these 2 queries to form a single graph to show usage by top 500 users and overall usage.

Tags (3)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Try this

| tstats sum(Accounting.Input) as Inp, sum(Accounting.Output) as out from datamodel="Accounting" by _time span=1h , Accounting.User_Name | eval tot=round((Inp+out)/100,2)  | sort -"Total" limit=500 by Accounting.User_Name | timechart span=1h sum(tot) as "Total"

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Try this

| tstats sum(Accounting.Input) as Inp, sum(Accounting.Output) as out from datamodel="Accounting" by _time span=1h , Accounting.User_Name | eval tot=round((Inp+out)/100,2)  | sort -"Total" limit=500 by Accounting.User_Name | timechart span=1h sum(tot) as "Total"

View solution in original post

0 Karma

Communicator

@somesoni2
Thank you... This query works !!
But.. it lists the top 500 "total" , maps it in the time range(x axis) when that value occurs. So I have just 500 values all together and the rest is null. I want the top 500 users overall. Lets say I select a time range of 7 days, I want the top 500 users for the 7 days and then I want to graph their usage for the 7 days. So the graph needs to be continuous.
Could you please help?

0 Karma