topic Re: Determine frequency over time in Splunk Search

Determine frequency over time

chrisj — Thu, 17 Sep 2020 03:53:31 GMT

I am attempting to work out the frequency of events over the selected timespan in weeks. Basically: count of events in current timespan divided by weeks in timespan.

I can get a count of events for the selected timespan using:

index=mydata | stats count(eval(ishotfix= "false")) as hfx | fields hfx

I can get the timepicker span weeks using (im sure this is terrible):

| makeresults | addinfo | eval timepickerSpanWeeks=round(((info_max_time - info_min_time)/60/60/24/7),0) | fields timepickerSpanWeeks

and if I combine I am getting no results

thanks in advance!

Re: Determine frequency over time

ITWhisperer — Thu, 17 Sep 2020 07:25:03 GMT

Try this

index=mydata | addinfo | eval timepickerSpanWeeks=round(((info_max_time - info_min_time)/60/60/24/7),0) | stats count(eval(ishotfix= "false")) as hfx | eval rate=round((hfx/timepickerSpanWeeks), 2)

Re: Determine frequency over time

chrisj — Thu, 17 Sep 2020 21:30:20 GMT

This is what got me the result, it seems like a poor way of getting it but the number of results isn't large. Happy for someone to revise! 🙂 Thanks for your help @ITWhisperer