Splunk Search

timecharting max of sum

robgreen
Path Finder

I generate a log file with one line per server with the time of the run as the splunk date.. something like

2013-05-30 12:04 UTC host=billybob activesessions=5
2013-05-30 12:04 UTC host=thelmalou activesessions=3
2013-05-30 12:05 UTC host=billybob activesessions=18
2013-05-30 12:05 UTC host=thelmalou activesessions=6

This repeats every 5 seconds. I would like a timechart of how many sessions i had for the entire system. right now i do something like

index=sessioncount | timechart span="5s" sum(activesessions) AS "Concurrent Sessions" 

this only works for about 40 minutes before i start losing data. i would like to generate this for hours if not days.

The key problem is that for every 5 seconds i need sum the values, then for every span find the max of the sum. IE i want the max number of concurrent sessions, not the total number of sessions in that span. so in the above example i sum the first 5 second window to 8, then the second which is 24, then in the chart for that hour (assuming span is 1h) use 24 for that data point.

All records for that run are imported at the exact time together as the key.

thanks

Tags (2)
0 Karma

bmacias84
Champion

You may want to use a saved search with a real time search or even summary indexing. I think you should be using Time modifers in your searches.


index=sessioncount earliest=@d latest=now | timechart span="5s" sum(activesessions) AS "Concurrent Sessions"

Additional Reading:

Hope this helps or gets you started. Dont forget to vote and accept answers that help.

Cheers,

0 Karma

bmacias84
Champion

Thats a perfect case for using summary indexing to roll ur data into a more manageable size. Using a seach to gather your sumarried data, then using a sub search for more current. Alternatively you can edit your limits.conf, but doing so has performance implications. Look at the iis web log app in splunk basr for examples.

0 Karma

robgreen
Path Finder

thanks, but i think the problem is the number of data points that timechart can handle, not the data range. ie "span=5s" i want summed, but then for whatever span timechart is in i need the "max"

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...