Splunk Search

Accum timeseries and grouping

Oren
Explorer

From our weblogs, I have extracted fields including http_bytes and http_domain. I would like to get a stacked chart of bandwidth consumed (accum http_bytes) by http_domain. My naive attempts have ended comically.

Related, I'd like to see for a given http_domain, I'm looking for two queries: how much bandwidth it used both for the search period, and a timechart for just that app.

Tags (2)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

I think it should just be:

sourcetype=myweblogs | chart sum(http_bytes) by http_domain

and

sourcetype=myweblogs http_domain="my_domain" | stats sum(http_bytes)
sourcetype=myweblogs http_domain="my_domain" | timechart span=5min sum(http_bytes)

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

I think it should just be:

sourcetype=myweblogs | chart sum(http_bytes) by http_domain

and

sourcetype=myweblogs http_domain="my_domain" | stats sum(http_bytes)
sourcetype=myweblogs http_domain="my_domain" | timechart span=5min sum(http_bytes)

Oren
Explorer

ah, thanks! I was mentally stuck on accum, which is clearly the wrong tool here.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>