topic I have to aggregate events in index by week and by month. in Splunk Search

I have to aggregate events in index by week and by month.

snigdhasaxena — Tue, 29 Sep 2020 20:32:35 GMT

I have tried using bin command but as
index=test| bin span=1w _time | chart count as total_count by _time, action

But this gives me event count over a span of 30days for every 7 days.

Please help me understand how to aggregate events in index by week and by month.

Re: I have to aggregate events in index by week and by month.

adonio — Wed, 18 Jul 2018 13:01:28 GMT

hello there,

try this out:

  index = test
    | bin _time span=1w as week
    | bin span=1mon _time as month
    | stats count as total_count by week month action
    | eval week_human = strftime(week, "%Y-%U")
    | eval month_human = strftime(month, "%Y-%B")

hope it helps

Re: I have to aggregate events in index by week and by month.

woodcock — Wed, 18 Jul 2018 13:18:57 GMT

It may be painful to do this on the raw data if you need to do this all the time, over and over. If you do, this is the kind of thing where a Summary Index is useful;

https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Configuresummaryindexes

If you aggregate daily, then it becomes trivial to mine it out by week or by month from your daily aggregation/summary.