topic Re: Regroup Splunk events with almost similar _time in Getting Data In

Regroup Splunk events with almost similar _time

Zakary_n — Wed, 30 Jan 2019 14:32:34 GMT

Hello all,

Every 10 seconds, I send a bunch of events to Splunk.
I need to count how many events I receive every 10 sec but I can't get the real number because of the fact that Splunk doesn't regroup them together if their time is even slightly different.

Very simple example :

10 : 00 : 10.052 Hello Splunk!
10 : 00 : 10.052 Hello Splunk!
10 : 00 : 10.054 Hello Splunk!
10 : 00 : 10.054 Hello Splunk!

10 : 00 : 20.052 Hello Splunk!
10 : 00 : 20.052 Hello Splunk!
10 : 00 : 20.055 Hello Splunk!

Splunk would regroup those events into 4 groups (events at 10.052 , 10.054, 20.052, 20.055) instead of 2 groups (events at 10.50 and at 20.50 for example).

For such an example, I would like to get something like :
10 : 00 : 10.00 -> 4 Hello Splunk
10 : 00 : 20.00 -> 3 Hello Splunk

Is there a workaround to that ?

Thank you.

Re: Regroup Splunk events with almost similar _time

vishaltaneja070 — Wed, 30 Jan 2019 14:50:25 GMT

try using timechart with span=10sec

i.e. |timechart count span=10s

Re: Regroup Splunk events with almost similar _time

Zakary_n — Wed, 30 Jan 2019 14:59:32 GMT

Completly forgot about timechart omg! Thank you, doing it atm

Re: Regroup Splunk events with almost similar _time

Zakary_n — Wed, 30 Jan 2019 15:24:20 GMT

Yeah simple as that. Should have thought about that, haven't used Splunk in quite a while. Thank you.

Re: Regroup Splunk events with almost similar _time

Zakary_n — Wed, 30 Jan 2019 15:26:03 GMT

See vishaltaneja07011993's answer.

Re: Regroup Splunk events with almost similar _time

vishaltaneja070 — Thu, 31 Jan 2019 05:52:50 GMT

@Zakary_n

Thank you 🙂