https://community.splunk.com/t5/Splunk-Search/How-do-I-compute-the-range-between-2-values-of-time-with/m-p/421206#M121003 <P>Hi,</P> <P>As you can see above, I did a "rename" command. Moreover, some host/sourcetype couple are well computed. But not all..</P> Fri, 19 Oct 2018 12:38:03 GMT davietch 2018-10-19T12:38:03Z https://community.splunk.com/t5/Splunk-Search/How-do-I-compute-the-range-between-2-values-of-time-with/m-p/421203#M121000 <P>Hi,</P> <P>I am trying to compute statistics about the Splunk data. To do so, I've got a datamodel with the number of events per host/sourcetype for each hour.</P> <P>So I can query it this way:</P> <PRE><CODE>| tstats count from datamodel="Splunk_Stats" where nodename="Host.Host_Per_Hour" Host.orig_host="*" Host.orig_sourcetype="*" AND earliest=-31d latest=@h by Host.orig_host,Host.orig_sourcetype,_time span=1h | rename Host.orig_host AS orig_host, Host.orig_sourcetype AS orig_sourcetype </CODE></PRE> <P>This works but then, I want to compute the range (difference between 2 successive values) of _time for each host/sourcetype.<BR /> So I add:</P> <PRE><CODE>... | streamstats global=false window=2 range(_time) AS r_time by orig_host, orig_sourcetype </CODE></PRE> <P>I do global=false and window=2, because, from my understanding, it will make Splunk compute the range for every two successive values for each individual host/sourcetype couple.</P> <P>For example:</P> <PRE><CODE>sourcetype _time A today B today A 2 days ago A 3 days ago A 4 days ago </CODE></PRE> <P>So the streamstats commands adds:</P> <PRE><CODE>sourcetype _time r_time A today 0 B today 0 A 2 days ago 2 A 3 days ago 1 A 4 days ago 1 </CODE></PRE> <P>Now, when I do this, it works if I filter down to a specific source type in my <CODE>tstats</CODE> command. But when there are several (a lot of) source types all mixed together (because I don't filter), the <CODE>streamstats</CODE> command does not compute the range and there is no r_time column...</P> <P>Any idea how to make it work?</P> Tue, 09 Oct 2018 15:31:20 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-compute-the-range-between-2-values-of-time-with/m-p/421203#M121000 davietch 2018-10-09T15:31:20Z https://community.splunk.com/t5/Splunk-Search/How-do-I-compute-the-range-between-2-values-of-time-with/m-p/421204#M121001 <P>Anyone please ?</P> Fri, 19 Oct 2018 08:22:57 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-compute-the-range-between-2-values-of-time-with/m-p/421204#M121001 davietch 2018-10-19T08:22:57Z https://community.splunk.com/t5/Splunk-Search/How-do-I-compute-the-range-between-2-values-of-time-with/m-p/421205#M121002 <P>@davietch,<BR /> It seems fieldnames are not getting recognized. can you try below-</P> <PRE><CODE> ... | streamstats global=false window=2 range(_time) AS r_time by Host.orig_host, Host.orig_sourcetype </CODE></PRE> Fri, 19 Oct 2018 10:39:26 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-compute-the-range-between-2-values-of-time-with/m-p/421205#M121002 493669 2018-10-19T10:39:26Z https://community.splunk.com/t5/Splunk-Search/How-do-I-compute-the-range-between-2-values-of-time-with/m-p/421206#M121003 <P>Hi,</P> <P>As you can see above, I did a "rename" command. Moreover, some host/sourcetype couple are well computed. But not all..</P> Fri, 19 Oct 2018 12:38:03 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-compute-the-range-between-2-values-of-time-with/m-p/421206#M121003 davietch 2018-10-19T12:38:03Z