timecharting max of sum

[robgreen]

I generate a log file with one line per server with the time of the run as the splunk date.. something like

2013-05-30 12:04 UTC host=billybob activesessions=5
2013-05-30 12:04 UTC host=thelmalou activesessions=3
2013-05-30 12:05 UTC host=billybob activesessions=18
2013-05-30 12:05 UTC host=thelmalou activesessions=6

This repeats every 5 seconds. I would like a timechart of how many sessions i had for the entire system. right now i do something like

index=sessioncount | timechart span="5s" sum(activesessions) AS "Concurrent Sessions" 

this only works for about 40 minutes before i start losing data. i would like to generate this for hours if not days.

The key problem is that for every 5 seconds i need sum the values, then for every span find the max of the sum. IE i want the max number of concurrent sessions, not the total number of sessions in that span. so in the above example i sum the first 5 second window to 8, then the second which is 24, then in the chart for that hour (assuming span is 1h) use 24 for that data point.

All records for that run are imported at the exact time together as the key.

thanks

[bmacias84]

You may want to use a saved search with a real time search or even summary indexing. I think you should be using Time modifers in your searches.

index=sessioncount earliest=@d latest=now | timechart span="5s" sum(activesessions) AS "Concurrent Sessions"

Additional Reading:

• SearchTimeModifiers

Hope this helps or gets you started. Dont forget to vote and accept answers that help.

Cheers,

[bmacias84]

Thats a perfect case for using summary indexing to roll ur data into a more manageable size. Using a seach to gather your sumarried data, then using a sub search for more current. Alternatively you can edit your limits.conf, but doing so has performance implications. Look at the iis web log app in splunk basr for examples.

[robgreen]

thanks, but i think the problem is the number of data points that timechart can handle, not the data range. ie "span=5s" i want summed, but then for whatever span timechart is in i need the "max"