get data by time

Learner — Tue, 08 Dec 2020 03:19:18 GMT

hi all, in my original search im getting data by folloing command:

| stats range(_time) as timetaken by CorrelationID| stats count as Total, avg(timetaken) as AvgResponseTime, perc95(timetaken) as P95ResponseTime

but now, i want this data on hourly basis. so i tried the following script:

|bin _time span=1d |eval Time=strftime(_time , "%d/%m/%Y %H:%M")| stats range(_time) as timetaken by CorrelationID| stats count as Total, avg(timetaken) as AvgResponseTime, perc95(timetaken) as P95ResponseTime by Time

but this gives me 0 value. i'm seeking for the right way to get data on hourly basis.

Re: get data by time

richgalloway — Tue, 08 Dec 2020 17:58:28 GMT

The bin command rounds off _time values to the day so all events that happen on the same day will have the same timestamp (2020-12-08T00:00:00 today, for example). The range(_time) function will return 0 on any given day.

To get hourly data, however, one should use span=1h rather than span=1d and use _time in the by clause of the final stats.

topic get data by time in Splunk Search

get data by time

Re: get data by time