change count in chart to actual value

[lewis269]

Hey,

i have two fields that i want to report on.
basically data from a wireless lan controller where we have "bytes received" and "username"

at the moment i can select both these fields and then visualize and it will show the usernames along the x axis which is what i want but it won't show the values for bytes recieved...only the "count" of events which isn't really useful.

essentially what i want to do is....
IF a username has more than 1 event then add "bytes received" together for each event into one value for each username.
the "bytes received" will be the Y axis and the usernames will be the X axis.

any idea on how i would do this? it's looking like it would be quite a complicated search??? but not sure.

Thanks in advance.

[lewis269 · Accepted solution]

As @nolesrb5343 said...this was the solution to the problem.

source="Wireless_Gobblers_20150504_102111_716.csv" host="prime" index="prime-test" sourcetype="ios:prime-test" "Bytes Received" > 0 | chart sum("Bytes Received") OVER "Client Username"

using sum over the field. relatively simple.

[jeffland]

You need to use sum("bytes received") for splunk to add the values of those fields together. Have a look here.
If you have any struggle with that, post your search and we'll help you modify it!

[lewis269]

source="Wireless_Gobblers_20150504_102111_716.csv" host="prime" index="prime-test" sourcetype="ios:prime-test" "Bytes Received" > 0

currently grabs all the events where the bytes received is more than 0 as we don't care about anything that doesn't send any data.
i can filter the sources to bytes received and username but then have a lot of trouble getting it into a readable graph where the bytes are on the Y axis and the usernames are on the X axis.

thanks

[nolesrb5343]

Have you tried ... | chart sum("bytes received") OVER usernames

[lewis269]

i understand the string...but where is "bytes" coming from? should that be "Bytes Received"??
sorry still wrapping my head around searching in Splunk

[lewis269]

Oh should be...this.

source="Wireless_Gobblers_20150504_102111_716.csv" host="prime" index="prime-test" sourcetype="ios:prime-test" "Bytes Received" > 0 | chart sum("Bytes Received") OVER "Client Username"

that works actually.