Splunk Search

Accum timeseries and grouping

Oren
Explorer

From our weblogs, I have extracted fields including http_bytes and http_domain. I would like to get a stacked chart of bandwidth consumed (accum http_bytes) by http_domain. My naive attempts have ended comically.

Related, I'd like to see for a given http_domain, I'm looking for two queries: how much bandwidth it used both for the search period, and a timechart for just that app.

Tags (2)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

I think it should just be:

sourcetype=myweblogs | chart sum(http_bytes) by http_domain

and

sourcetype=myweblogs http_domain="my_domain" | stats sum(http_bytes)
sourcetype=myweblogs http_domain="my_domain" | timechart span=5min sum(http_bytes)

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

I think it should just be:

sourcetype=myweblogs | chart sum(http_bytes) by http_domain

and

sourcetype=myweblogs http_domain="my_domain" | stats sum(http_bytes)
sourcetype=myweblogs http_domain="my_domain" | timechart span=5min sum(http_bytes)

Oren
Explorer

ah, thanks! I was mentally stuck on accum, which is clearly the wrong tool here.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...