topic Re: Grouping _time in Splunk Search

Grouping _time

tahasefiani — Thu, 12 Mar 2020 10:40:05 GMT

Hello,

I have this query

| loadjob savedsearch="myquery"
  | where (strftime(_time, "%Y-%m-%d") >= "2020-02-26") AND (strftime(_time, "%Y-%m-%d") <= "2020-03-03") and STEP=="Click"
  | bucket _time span=1d
  |stats min(_time) as _time by MESSAGE
  |where MESSAGE = "337668c2-162c-4f4f-bda9-92f7816f2752" OR MESSAGE = "46095117-4dcb-4ebc-9906-8c23f1a1a26b" OR MESSAGE = "60eb62a4-c54a-4fc0-9aaa-17726ff62929" OR MESSAGE = "8b5e055c-17ab-4135-8b90-1fbc65032792"

Now i want to count the MESSAGE by _time

This is what i have as result

And this is what i want

Thanks for help

Re: Grouping _time

manjunathmeti — Thu, 12 Mar 2020 10:51:52 GMT

use stats count:

| loadjob savedsearch="myquery"
| where (strftime(_time, "%Y-%m-%d") >= "2020-02-26") AND (strftime(_time, "%Y-%m-%d") <= "2020-03-03") and STEP=="Click"
| bucket _time span=1d
|stats min(_time) as _time by MESSAGE
|where MESSAGE = "337668c2-162c-4f4f-bda9-92f7816f2752" OR MESSAGE = "46095117-4dcb-4ebc-9906-8c23f1a1a26b" OR MESSAGE = "60eb62a4-c54a-4fc0-9aaa-17726ff62929" OR MESSAGE = "8b5e055c-17ab-4135-8b90-1fbc65032792"
| stats count by _time

Re: Grouping _time

tahasefiani — Thu, 12 Mar 2020 13:22:40 GMT

@manjunathmeti the problème is that i can't do my join on _time. DO you have a solution to that?

Re: Grouping _time

manjunathmeti — Thu, 12 Mar 2020 13:29:24 GMT

Convert _time.

| loadjob savedsearch="myquery"
| where (strftime(_time, "%Y-%m-%d") >= "2020-02-26") AND (strftime(_time, "%Y-%m-%d") <= "2020-03-03") and STEP=="Click"
| bucket _time span=1d
| stats min(_time) as _time by MESSAGE
| where MESSAGE = "337668c2-162c-4f4f-bda9-92f7816f2752" OR MESSAGE = "46095117-4dcb-4ebc-9906-8c23f1a1a26b" OR MESSAGE = "60eb62a4-c54a-4fc0-9aaa-17726ff62929" OR MESSAGE = "8b5e055c-17ab-4135-8b90-1fbc65032792"
| eval time=strftime(_time, "%d/%m/%Y")
| stats count by time

Re: Grouping _time

tahasefiani — Thu, 12 Mar 2020 16:30:52 GMT

@manjunathmeti junathm it's does't work as a timechart

Re: Grouping _time

manjunathmeti — Fri, 13 Mar 2020 16:17:11 GMT

can you comment your whole search query?