topic Timespan based output in Splunk Search

Timespan based output

poddraj — Wed, 30 Sep 2020 05:14:44 GMT

Hi
Can someone help me in getting o/p over 1h interval along with Total requests count, Success count, Failure count

I have written below query but am not getting the Total count as separate column for every 1h interval span

index=dte_fios sourcetype=dte2_Fios FT=*FT | eval Interval=strftime('_time',"%d-%m-%Y %H:%M:%S")
| eval Status=case(Error_Code=="0000","Success",1=1,"Failure")
| timechart span=1h count by Status

It is giving O/p as
_time Success Failure
2020-04-20 05:00 120 90

I need O/P as
_time Total Failure Success
2020-04-20 05:00 210 90 120

Re: Timespan based output

richgalloway — Tue, 28 Apr 2020 15:42:07 GMT

You're not getting the total count because your query does not mention total count.

index=dte_fios sourcetype=dte2_Fios FT=*FT 
| eval Status=case(Error_Code=="0000","Success",1=1,"Failure")
| timechart span=1h count by Status
| eval Total = Success + Failure
| table _time Total Failure Success

Re: Timespan based output

poddraj — Wed, 29 Apr 2020 08:58:15 GMT

Thanks....