Splunk Search

Sum session value from several servers?

mibo
New Member

Hi all,
I've been trying hard for two days now, but doesn't seem to find how to query to get the following graph:

I have three servers. All three have a performance counter called "Active SMTP Sessions" which returns the following field
"Active SMTP Sessions" = 23

I'd like a graph that shows the total amount of SMTP sessions, a sum of the same performance counter from all three servers.

I've managed to do a timechart showing the three values by host followed by the addtotal, and that's nice.
But I really only want the Total on my chart, not all thre servers plus total.

Any ideas?

Tags (2)
0 Karma

hexx
Splunk Employee
Splunk Employee

This doesn't do the trick?

... | timechart sum(active_SMTP_sessions) AS "Total active SMTP sessions"

Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...