topic Re: How do I create a timechart with spans that aren't aligned to the start of a minute/hour/day etc? in Splunk Search

How do I create a timechart with spans that aren't aligned to the start of a minute/hour/day etc?

lukemundy — Fri, 19 Oct 2018 02:24:47 GMT

I'm using timechat to count the number of events per minute in a single value display: search | timechart span=1m count

This works fine. However, each time span is aligned to the top of the minute, meaning that the single value is only ever accurate when the search is conducted at the top of the minute. I want my single value to display the total number of requests in the last minute from now and not the last whole minute.

For example, if the search is running at 12:15:39, the single value should show the count of events between 12:14:39 and 12:15:39, rather than the count from 12:14:00 to 12:15:00 (or, if using partial=true, 12:15:00 to 12:15:39)

Is timechart suitable for this or do I need to use another method?

Re: How do I create a timechart with spans that aren't aligned to the start of a minute/hour/day etc?

DalJeanis — Fri, 26 Oct 2018 21:59:43 GMT

You can add/subtract an offset, run your timechart, then subtract/add it back.

Here's a run-anywhere example...

 index=_internal earliest=-610s 
| addinfo | eval delay=info_max_time % 60 | eval _time = _time - delay 
| timechart span=1m count  
| addinfo | eval delay=info_max_time % 60 | eval _time = _time + delay | fields - delay info*

Notes

1) timechart kills the calculated field, so you have to do it all over again, then delete the added fields as well.

2) You can use info_max_time or info_min_time, depending on whether you are more concerned about aligning the start of the period or the end of the period. They are functionally equivalent except for edge cases.

Re: How do I create a timechart with spans that aren't aligned to the start of a minute/hour/day etc?

woodcock — Wed, 31 Oct 2018 18:39:21 GMT

You can add/remove any arbitrary time-segment like this:

Your Base Search Here
[| makeresults 
 | rename COMMENT AS "This expands the window by 1 minute on each side"
 | addinfo 
 | eval search = "earliest=" . (info_min_time - 60) . " latest=" . (info_max_time + 60)
 | table search]
| timechart count span=1m