Splunk Search

timechart total mb per source

arjangoos
Path Finder

I want to create a timechart line graph based on: total kb per source over time. Now I have:

index="_internal" source="*metrics.log" per_source_thruput access_log | bin _time span=1d as day | timechart sum(kb) as totalKB | streamstats sum(totalKB)

This search works but only for access_log, I want to see all sources in one graph

time size result

on 0:00 100kb 100kb

on 1:00 50kb 150kb

on 1:30 27kb 177kb

Tags (1)
0 Karma

arjangoos
Path Finder

Ok thanks for your reply. But it is not an answer to my question. So if anyone knows how I can solve my problem.

0 Karma

yannK
Splunk Employee
Splunk Employee

so you can use the same search, differentiate per series. (the bucket is not necessary, timechart will to it)


index=_internal source="*metrics.log" per_source_thruput |timechart span=1d sum(kb) as totalKB by series | streamstats sum(totalKB)

the totalKB will be the total of each day added the previous days, if you want total per unique day, use |addtotals


index=_internal source="*metrics.log" per_source_thruput |timechart span=1d sum(kb) as totalKB by series | addtotals

then click on the graph display (the third display mode)

0 Karma

yannK
Splunk Employee
Splunk Employee

Do you know that metrics.log contains only a sample of the measures (top 10), this means that you can look at speed measures, but not a volume, especially if yo have more than 10 sources...

if you want to measure precisely the volume per source, check this guide, using license_usage.log

http://wiki.splunk.com/Community:TroubleshootingIndexedDataVolume

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...