topic Display count for multiple time increments in Splunk Search

Display count for multiple time increments

cejohnson — Wed, 20 Jul 2011 22:13:28 GMT

I have log data that tracks the completion of jobs. I'd like to be able to track the completed jobs, but for 4 different increments: the last 5 minutes, last 30 minutes, last hour, and last 24 hours, and I'd like it to be displayed in a table, something like this.

JobType | 5mins  | 30mins | 60mins | 24hrs  
AA          2        30      100       150
BB          0        10       20        30

And the data resembles something like this:

<timestamp> JobType=AA status=Finished
<timestamp> JobType=BB status=Finished

I can do a count on status=Finished and dump that to a simpleResultsTable by JobType for the entire log file or for a single start/end period. But how would I send that to a simpleResultsTable for multiple increments?

Re: Display count for multiple time increments

David — Wed, 20 Jul 2011 22:54:45 GMT

You should be able to use eval and relative_time to sort this one out:

status=Finished 
      | stats sum(eval(if(_time > relative_time(now(), "-5m"),1,0))) as 5mins,  
              sum(eval(if(_time > relative_time(now(), "-30m"),1,0))) as 30mins,  
              sum(eval(if(_time > relative_time(now(), "-60m"),1,0))) as 60mins,  
              sum(eval(if(_time > relative_time(now(), "-24h"),1,0))) as 24hrs by JobType

Let me know if that works.

Re: Display count for multiple time increments

cejohnson — Wed, 20 Jul 2011 23:33:51 GMT

Yes that works. Thanks!

Re: Display count for multiple time increments

David — Fri, 22 Jul 2011 07:33:29 GMT

Excellent! I'm glad to hear that.