Splunk Search

graph only cumulative data with timechart and streamstats

bill_bartlett
Path Finder

I've found this on the Splunk wiki that gives great examples on how to graph several sources and their cumulative totals: http://wiki.splunk.com/Community:Search_Report:_How_To_Create_a_Chart_of_Hourly_and_Accumulated_Inde...

Is it possible to use a similar method, but to only graph the cumulative total and not each of the individual sources that make up that total?

0 Karma
1 Solution

somesoni2
Revered Legend

Just add a table/fields command to remove other columns.

Query version from Blogpost

index=_internal group="per_index_thruput" earliest=@d latest=@h
   | eval mb=kb/1024
   | timechart span=1h sum(mb) as HourlyTotal by series
   | addtotals fieldname=HourlyTotal
   | streamstats sum(HourlyTotal) AS AccumulatedTOTAL 
   | table _time AccumulatedTOTAL

Another version

  index=_internal group="per_index_thruput" earliest=@d latest=@h
       | eval mb=kb/1024
       | timechart span=1h sum(mb) as HourlyTotal
       | streamstats sum(HourlyTotal) AS AccumulatedTOTAL 
       | table _time AccumulatedTOTAL

View solution in original post

somesoni2
Revered Legend

Just add a table/fields command to remove other columns.

Query version from Blogpost

index=_internal group="per_index_thruput" earliest=@d latest=@h
   | eval mb=kb/1024
   | timechart span=1h sum(mb) as HourlyTotal by series
   | addtotals fieldname=HourlyTotal
   | streamstats sum(HourlyTotal) AS AccumulatedTOTAL 
   | table _time AccumulatedTOTAL

Another version

  index=_internal group="per_index_thruput" earliest=@d latest=@h
       | eval mb=kb/1024
       | timechart span=1h sum(mb) as HourlyTotal
       | streamstats sum(HourlyTotal) AS AccumulatedTOTAL 
       | table _time AccumulatedTOTAL

bill_bartlett
Path Finder

Thank you, this is almost perfect. Is there a way to format the time bucket on the chart? As it is now, the format makes for a very ugly chart if graphing more than a handful of columns.

0 Karma

bill_bartlett
Path Finder

I've figured it out. This search works perfect for my needs:

index=_internal group="per_index_thruput" earliest=@d latest=@h
    | eval mb=kb/1024
    | timechart span=1h sum(mb) as HourlyTotal by series
    | addtotals fieldname=HourlyTotal
    | streamstats sum(HourlyTotal) AS AccumulatedTOTAL 
    | table _time AccumulatedTOTAL
    | eval _time=strftime(_time, "%m/%d %H:%M")
Get Updates on the Splunk Community!

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...