topic Re: time range splunk search & increase time range in All Apps and Add-ons

time range splunk search & increase time range

rups260386 — Sun, 16 Jun 2019 08:37:47 GMT

currently when I am running below query getting hourly count, but I need to have count always start from 00:00 to 01:00, 00:00 to 02:00, 00:00 to 03:00, 00:00 to 04:00, 00:00 to 05:00 ....... 00:00 to current hour.

How I can modify below query so that I will get output hourly but search clock always start from 00:00. It would be great if anyone can help me.

index=mdp_ivc_cdrs sourcetype=prd_mdp_ivc_cdrs earliest=@d latest=now | bucket _time span=1h |timechart span=1h count(eval(like(INGRESS_TRUNKCONTEXT,"%amazon%"))) as "Outound Calls",count(eval(like(INGRESS_TRUNKCONTEXT,"%vodafone%"))) as "Inbound Calls",count(eval(like(INGRESS_TRUNKCONTEXT,"%amazon%") AND CDR_TYPE=2 AND ANSWERED_CALL=1)) as "Outbound Answered Calls",count(eval(like(INGRESS_TRUNKCONTEXT,"%vodafone%") AND CDR_TYPE=2 AND ANSWERED_CALL=1)) as "Inbound  Answered Calls"

Re: time range splunk search & increase time range

martinpu — Sun, 16 Jun 2019 12:00:10 GMT

I am not sure I understand the question, as it seems your query already accomplishes this task.

earliest=@d

in your query, does what you are requesting

Please explain further
Edit:

Are you looking for a cumulative count?

Try this:

index=mdp_ivc_cdrs sourcetype=prd_mdp_ivc_cdrs earliest=@d latest=now 
| bucket _time span=1h 
| timechart span=1h count(eval(like(INGRESS_TRUNKCONTEXT,"%amazon%"))) as "Outound Calls",count(eval(like(INGRESS_TRUNKCONTEXT,"%vodafone%"))) as "Inbound Calls",count(eval(like(INGRESS_TRUNKCONTEXT,"%amazon%") AND CDR_TYPE=2 AND ANSWERED_CALL=1)) as "Outbound Answered Calls",count(eval(like(INGRESS_TRUNKCONTEXT,"%vodafone%") AND CDR_TYPE=2 AND ANSWERED_CALL=1)) as "Inbound  Answered Calls" 
| streamstats sum("Outbound Calls") ,sum("Inbound Calls") , sum("Outbound Answered Calls") ,sum("Inbound  Answered Calls")

Re: time range splunk search & increase time range

DavidHourani — Sun, 16 Jun 2019 13:36:58 GMT

Hi @rups260386,

Since you're already counting hour by hour from earliest=@d then all you have to do is add this to the end of your search |streamstats sum(*) as *to make an incremental sum of the results.

Your search should then look like this :

index=mdp_ivc_cdrs sourcetype=prd_mdp_ivc_cdrs earliest=@d latest=now 
| bucket _time span=1h 
| timechart span=1h count(eval(like(INGRESS_TRUNKCONTEXT,"%amazon%"))) as "Outound Calls",count(eval(like(INGRESS_TRUNKCONTEXT,"%vodafone%"))) as "Inbound Calls",count(eval(like(INGRESS_TRUNKCONTEXT,"%amazon%") AND CDR_TYPE=2 AND ANSWERED_CALL=1)) as "Outbound Answered Calls",count(eval(like(INGRESS_TRUNKCONTEXT,"%vodafone%") AND CDR_TYPE=2 AND ANSWERED_CALL=1)) as "Inbound  Answered Calls"
|streamstats sum(*) as *

Cheers,
David