https://community.splunk.com/t5/Splunk-Search/How-can-I-make-my-table-results-in-3s-time-intervals/m-p/425869#M122071 <P>Hey..I'm seeing a problem, the time stamp is repeating in some cases</P> Fri, 07 Dec 2018 17:36:02 GMT moizmmz 2018-12-07T17:36:02Z https://community.splunk.com/t5/Splunk-Search/How-can-I-make-my-table-results-in-3s-time-intervals/m-p/425862#M122064 <P>Query I am running:</P> <PRE><CODE>index="dcg-video-eng-live-services-stage" | spath "message.req.originalUrl" | search "message.req.originalUrl"!="/health-check"| spath severity | search severity!=warn|search message.extraLogInfo./api2/asset/get.assets{}.desc!=null() |table _time message.extraLogInfo./api2/asset/get.assets{}.desc message.extraLogInfo./api2/asset/get.assets{}.duration | rename message.extraLogInfo./api2/asset/get.assets{}.desc as Channel, message.extraLogInfo./api2/asset/get.assets{}.duration as Duration |sort -_time </CODE></PRE> <P>This results in the following table:</P> <P><A href="https://drive.google.com/open?id=1PaUuxMNy29QYtjzKbc2i0ulGybXXSnL6">https://drive.google.com/open?id=1PaUuxMNy29QYtjzKbc2i0ulGybXXSnL6</A> (also shown in image)</P> <P>As shown in the image, the results have varying time intervals. <BR /> I want to get the results in the table to be in time intervals of <STRONG>3s</STRONG>.</P> <P>How do I go about doing it?</P> <P>Thanks!</P> Thu, 06 Dec 2018 23:50:43 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-make-my-table-results-in-3s-time-intervals/m-p/425862#M122064 moizmmz 2018-12-06T23:50:43Z https://community.splunk.com/t5/Splunk-Search/How-can-I-make-my-table-results-in-3s-time-intervals/m-p/425863#M122065 <P>try adding at the end</P> <P>| bin _time span=3s | stats values(channel), values(duaration)</P> Fri, 07 Dec 2018 00:42:31 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-make-my-table-results-in-3s-time-intervals/m-p/425863#M122065 nagarjuna280 2018-12-07T00:42:31Z https://community.splunk.com/t5/Splunk-Search/How-can-I-make-my-table-results-in-3s-time-intervals/m-p/425864#M122066 <P>Nope.<BR /> The results are mv and without a timestamp.</P> Fri, 07 Dec 2018 01:07:25 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-make-my-table-results-in-3s-time-intervals/m-p/425864#M122066 moizmmz 2018-12-07T01:07:25Z https://community.splunk.com/t5/Splunk-Search/How-can-I-make-my-table-results-in-3s-time-intervals/m-p/425865#M122067 <P>Hi,</P> <P>Can you try the below search,</P> <PRE><CODE>index="dcg-video-eng-live-services-stage" | spath "message.req.originalUrl" | search "message.req.originalUrl"!="/health-check"| spath severity | search severity!=warn|search message.extraLogInfo./api2/asset/get.assets{}.desc!=null() |table _time message.extraLogInfo./api2/asset/get.assets{}.desc message.extraLogInfo./api2/asset/get.assets{}.duration | rename message.extraLogInfo./api2/asset/get.assets{}.desc as Channel, message.extraLogInfo./api2/asset/get.assets{}.duration as Duration |sort -_time | mvexpand Channel | mvexpand Duration | bin span=3s _time | stats values(Channel) as Channel, values(Duration) as Duration by _time </CODE></PRE> Fri, 07 Dec 2018 06:19:19 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-make-my-table-results-in-3s-time-intervals/m-p/425865#M122067 sdchakraborty 2018-12-07T06:19:19Z https://community.splunk.com/t5/Splunk-Search/How-can-I-make-my-table-results-in-3s-time-intervals/m-p/425866#M122068 <P>It is giving me the 3s interval. Thanks <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>But its also giving me other data I don't want. Sorta combining two mv values</P> Fri, 07 Dec 2018 17:22:55 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-make-my-table-results-in-3s-time-intervals/m-p/425866#M122068 moizmmz 2018-12-07T17:22:55Z https://community.splunk.com/t5/Splunk-Search/How-can-I-make-my-table-results-in-3s-time-intervals/m-p/425867#M122069 <P>Cool.please accept it as answer if it is resolved your issue.</P> Fri, 07 Dec 2018 17:26:29 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-make-my-table-results-in-3s-time-intervals/m-p/425867#M122069 sdchakraborty 2018-12-07T17:26:29Z https://community.splunk.com/t5/Splunk-Search/How-can-I-make-my-table-results-in-3s-time-intervals/m-p/425868#M122070 <P>But on explicitly eliminating that data using '!=', I got what I wanted <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>Thank you!!</P> Fri, 07 Dec 2018 17:27:19 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-make-my-table-results-in-3s-time-intervals/m-p/425868#M122070 moizmmz 2018-12-07T17:27:19Z https://community.splunk.com/t5/Splunk-Search/How-can-I-make-my-table-results-in-3s-time-intervals/m-p/425869#M122071 <P>Hey..I'm seeing a problem, the time stamp is repeating in some cases</P> Fri, 07 Dec 2018 17:36:02 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-make-my-table-results-in-3s-time-intervals/m-p/425869#M122071 moizmmz 2018-12-07T17:36:02Z https://community.splunk.com/t5/Splunk-Search/How-can-I-make-my-table-results-in-3s-time-intervals/m-p/425870#M122072 <P>Never mind, used dedup <span class="lia-unicode-emoji" title=":face_with_tongue:">😛</span></P> Fri, 07 Dec 2018 17:51:35 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-make-my-table-results-in-3s-time-intervals/m-p/425870#M122072 moizmmz 2018-12-07T17:51:35Z