topic Re: Combine events based on timestamps in event in Splunk Search

Combine events based on timestamps in event

manuarora12 — Tue, 14 Nov 2017 11:10:43 GMT

I have events as following
Category=a starttime="2017-11-14 05:25:22"
Category=b starttime="2017-11-14 05:29:22"
Category=b starttime="2017-11-14 04:28:18"
Category=c starttime="2017-11-14 03:22:21"
Category=a starttime="2017-11-14 06:21:28"

I want all events count by Category by hour of occurance as per starttime. _time might be completely different from starttime.

So results should say something like

Hour Category Count
5 a 1
b 1
6 b 1

Re: Combine events based on timestamps in event

knielsen — Tue, 14 Nov 2017 13:16:43 GMT

What about

<your search> | rex field=starttime "\S{10}\s(?<Hour>\d\d)" | stats count by Hour, Category

Regards,
Kai.

Re: Combine events based on timestamps in event

niketn — Tue, 14 Nov 2017 20:54:15 GMT

@manuarora12, you can try the following:

<YourBaseSearch>
|  eval _time=strptime(starttime,"%Y-%m-%d %H:%M:%S")
|  timechart span=1h count by Category