Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

timecharting max of sum

$
0
0

I generate a log file with one line per server with the time of the run as the splunk date.. something like

2013-05-30 12:04 UTC host=billybob activesessions=5
2013-05-30 12:04 UTC host=thelmalou activesessions=3
2013-05-30 12:05 UTC host=billybob activesessions=18
2013-05-30 12:05 UTC host=thelmalou activesessions=6

This repeats every 5 seconds. I would like a timechart of how many sessions i had for the entire system. right now i do something like

index=sessioncount | timechart span="5s" sum(activesessions) AS "Concurrent Sessions"

this only works for about 40 minutes before i start losing data. i would like to generate this for hours if not days.

The key problem is that for every 5 seconds i need sum the values, then for every span find the max of the sum. IE i want the max number of concurrent sessions, not the total number of sessions in that span. so in the above example i sum the first 5 second window to 8, then the second which is 24, then in the chart for that hour (assuming span is 1h) use 24 for that data point.

All records for that run are imported at the exact time together as the key.

thanks


Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>