I generate a log file with one line per server with the time of the run as the splunk date.. something like
2013-05-30 12:04 UTC host=billybob activesessions=5
2013-05-30 12:04 UTC host=thelmalou activesessions=3
2013-05-30 12:05 UTC host=billybob activesessions=18
2013-05-30 12:05 UTC host=thelmalou activesessions=6
This repeats every 5 seconds. I would like a timechart of how many sessions i had for the entire system. right now i do something like
index=sessioncount | timechart span="5s" sum(activesessions) AS "Concurrent Sessions"
this only works for about 40 minutes before i start losing data. i would like to generate this for hours if not days.
The key problem is that for every 5 seconds i need sum the values, then for every span find the max of the sum. IE i want the max number of concurrent sessions, not the total number of sessions in that span. so in the above example i sum the first 5 second window to 8, then the second which is 24, then in the chart for that hour (assuming span is 1h) use 24 for that data point.
All records for that run are imported at the exact time together as the key.
thanks