https://community.splunk.com/t5/Splunk-Search/Event-sampling-with-specific-event-gaps-for-multiple-hosts/m-p/354252#M174648 <P>You can use this:</P> <PRE><CODE>... | bin _time span=15m </CODE></PRE> <P>This will round all events down to the nearest 15-minute boundary. Now you can do your other magic.</P> Fri, 16 Jun 2017 01:53:40 GMT woodcock 2017-06-16T01:53:40Z https://community.splunk.com/t5/Splunk-Search/Event-sampling-with-specific-event-gaps-for-multiple-hosts/m-p/354250#M174646 <P>I have multiple hosts in my result table and there is no specific sampling interval for each. However it is sure that in every host there are events at every 15 minutes though there can be variable number/ time of other events in between. How do I select the 15 minutes events from every host separately since I have to take the stats of the fields for every host separately.</P> Thu, 15 Jun 2017 09:57:08 GMT https://community.splunk.com/t5/Splunk-Search/Event-sampling-with-specific-event-gaps-for-multiple-hosts/m-p/354250#M174646 AshimaE 2017-06-15T09:57:08Z https://community.splunk.com/t5/Splunk-Search/Event-sampling-with-specific-event-gaps-for-multiple-hosts/m-p/354251#M174647 <P>Can you share some of your SPL query and/or raw data? I am having a difficult time understanding what exactly you mean.</P> Thu, 15 Jun 2017 10:19:13 GMT https://community.splunk.com/t5/Splunk-Search/Event-sampling-with-specific-event-gaps-for-multiple-hosts/m-p/354251#M174647 rjthibod 2017-06-15T10:19:13Z https://community.splunk.com/t5/Splunk-Search/Event-sampling-with-specific-event-gaps-for-multiple-hosts/m-p/354252#M174648 <P>You can use this:</P> <PRE><CODE>... | bin _time span=15m </CODE></PRE> <P>This will round all events down to the nearest 15-minute boundary. Now you can do your other magic.</P> Fri, 16 Jun 2017 01:53:40 GMT https://community.splunk.com/t5/Splunk-Search/Event-sampling-with-specific-event-gaps-for-multiple-hosts/m-p/354252#M174648 woodcock 2017-06-16T01:53:40Z https://community.splunk.com/t5/Splunk-Search/Event-sampling-with-specific-event-gaps-for-multiple-hosts/m-p/354253#M174649 <P>If you want to average the samples in every 15m interval<BR /> ... <BR /> | bin _time span=15m<BR /> | stats avg(Value) as Value by _time host</P> <P>If you want the first event out of every 15 minute interval and you know there will always be one...<BR /> ...<BR /> | bin _time as Time span=15m<BR /> | stats earliest(Value) as Value by Time host</P> Fri, 16 Jun 2017 03:12:10 GMT https://community.splunk.com/t5/Splunk-Search/Event-sampling-with-specific-event-gaps-for-multiple-hosts/m-p/354253#M174649 DalJeanis 2017-06-16T03:12:10Z