topic Timechart after Stats in Splunk ITSI

Timechart after Stats

andy — Mon, 20 Jul 2020 17:49:18 GMT

Hi everyone,

I am trying to create a timechart showing distribution of accesses in last 24h filtered through stats command. More precisely I am sorting services with low accesses number but higher than 2 and considerating only 4 less accessed services using this:

Results would show services with number of accesses of 1 or 2 in a day despite the where clause. Thank you in advance for your help.

Re: Timechart after Stats

richgalloway — Mon, 20 Jul 2020 17:06:03 GMT

The timechart command requires events to be in time order, but the query uses sort to put them in a different order. Try removing the sort.

Re: Timechart after Stats

andy — Mon, 20 Jul 2020 18:04:16 GMT

But if I remove the sort how can I choose the 4 less accessed services?

This search gives me a list of data :

| stats count by Service _time
| where count>2
| sort 4 count

for instance in last 24h

Service | Accesses
A | 3

B | 5

How can I reproduce a chart that would show me how this services are distributed hour per hour in last 24h?

Re: Timechart after Stats

richgalloway — Mon, 20 Jul 2020 18:51:49 GMT

Re-sort the results by time.

Re: Timechart after Stats

andy — Mon, 20 Jul 2020 20:06:17 GMT

Don't know why but in this way it only shows 1 service which reached 4 accesses in 1 hour, instead I would like to have a hour by hour timechart of the last 4 services by sum of daily events and having sum > 2 .

Re: Timechart after Stats

richgalloway — Mon, 20 Jul 2020 21:33:26 GMT

Something like this?

Here's the search that produced it.

Re: Timechart after Stats

andy — Tue, 21 Jul 2020 07:46:23 GMT

Yeah something like this is what I'm looking for, but first I need to consider only 4 services with lowest daily count

Re: Timechart after Stats

richgalloway — Tue, 21 Jul 2020 12:44:00 GMT

The query I gave you shows only 4 services.