https://community.splunk.com/t5/Splunk-Search/How-can-I-calculate-the-number-of-errors-for-the-last-hour-for-a/m-p/370949#M109148 <P>I assume you intend to create some statistics about the events from the last full hour, e.g. at 09:36, you want all events wich occurred between 08:00 and 08:59.59.999 so, <STRONG>earliest=-1h@h latest=@h</STRONG> will give you just this events. There you may just append your stats function. I don't know if you can have an eval in a count, I had to take the eval out of the count function on some occasions. <BR /> If you need the count per full hour for some time, e.g the last day, then my best guess would be to use span.</P> Wed, 16 Aug 2017 06:39:21 GMT FritzWittwer_ol 2017-08-16T06:39:21Z https://community.splunk.com/t5/Splunk-Search/How-can-I-calculate-the-number-of-errors-for-the-last-hour-for-a/m-p/370946#M109145 <P>Hi All,<BR /> I'm trying to do a simple search on a log based on relative time, i.e. I need to calculate number of errors for last hour for a period of time and get the min/max in that time span.<BR /> eg: If I login now at 1:15 AM I should see the results from 00:00 to 1:00 A.M and I need that values for a period of time where I can find the min/max for that period.</P> <P>So for that the below query which I'm trying is not working.</P> <P>index=xyz|eval Time1=strftime(relative_time(now(),"-1h")|table Time1|dedup time1|Join Time1[search index =xyz|eval testDate=strftime(_time,"%Y-%m-%d")|eval Time1=strftime(_time,"%H")|stats count(eval(Logstate="Reject") as RejectCount by TestDate Time1]</P> <P>But the below query doesnt fetch the desired result. So, could anyone help with the above query?</P> <P>Thanks in advance</P> Tue, 29 Sep 2020 15:22:07 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-calculate-the-number-of-errors-for-the-last-hour-for-a/m-p/370946#M109145 snam 2020-09-29T15:22:07Z https://community.splunk.com/t5/Splunk-Search/How-can-I-calculate-the-number-of-errors-for-the-last-hour-for-a/m-p/370947#M109146 <PRE><CODE>index=xyz earliest=-1h@h latest=@h ... </CODE></PRE> <P>see <A href="https://docs.splunk.com/Documentation/SplunkCloud/6.6.1/SearchReference/SearchTimeModifiers">Time Modifiers</A></P> Wed, 16 Aug 2017 06:20:54 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-calculate-the-number-of-errors-for-the-last-hour-for-a/m-p/370947#M109146 FritzWittwer_ol 2017-08-16T06:20:54Z https://community.splunk.com/t5/Splunk-Search/How-can-I-calculate-the-number-of-errors-for-the-last-hour-for-a/m-p/370948#M109147 <P>i am not sure of the join logic.. <BR /> but, when you run the 2nd part alone, will it give results?</P> <PRE>index=xyz|eval testDate=strftime(_time,"%Y-%m-%d")|eval Time1=strftime(_time,"%H")|stats count(eval(Logstate="Reject") as RejectCount by TestDate Time1| table RejectCount TestDate Time1</PRE> Wed, 16 Aug 2017 06:26:18 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-calculate-the-number-of-errors-for-the-last-hour-for-a/m-p/370948#M109147 inventsekar 2017-08-16T06:26:18Z https://community.splunk.com/t5/Splunk-Search/How-can-I-calculate-the-number-of-errors-for-the-last-hour-for-a/m-p/370949#M109148 <P>I assume you intend to create some statistics about the events from the last full hour, e.g. at 09:36, you want all events wich occurred between 08:00 and 08:59.59.999 so, <STRONG>earliest=-1h@h latest=@h</STRONG> will give you just this events. There you may just append your stats function. I don't know if you can have an eval in a count, I had to take the eval out of the count function on some occasions. <BR /> If you need the count per full hour for some time, e.g the last day, then my best guess would be to use span.</P> Wed, 16 Aug 2017 06:39:21 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-calculate-the-number-of-errors-for-the-last-hour-for-a/m-p/370949#M109148 FritzWittwer_ol 2017-08-16T06:39:21Z https://community.splunk.com/t5/Splunk-Search/How-can-I-calculate-the-number-of-errors-for-the-last-hour-for-a/m-p/370950#M109149 <P>For writing a better search you should filter required results as early in your search as possible. In your case since you are interested only for Rejected events you should include Logstate="Reject" in your base search and just print the count.</P> <PRE><CODE>index=xyz earliest=-1h@h latest=@h Logstate="Reject" | stats count as RejectCount min(_time) as EarliestEventTime max(_time) as LatestEventTime | addinfo | fieldformat info_min_time=strftime(info_min_time,"%c") | fieldformat info_max_time=strftime(info_max_time,"%c") | fieldformat EarliestEventTime=strftime(EarliestEventTime ,"%c") | fieldformat LatestEventTime=strftime(LatestEventTime,"%c") | fields - info_search_time info_sid </CODE></PRE> <P>PS: All the time fields are added for you to see your search's earliest and latest time (i.e. info_min_time and info_max_time) and also your earliest and latest events (EarliestEventTime,LatestEventTime). You can remove these fields if you don't require or have tested the results as per your need.</P> Tue, 29 Sep 2020 15:26:31 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-calculate-the-number-of-errors-for-the-last-hour-for-a/m-p/370950#M109149 niketn 2020-09-29T15:26:31Z