topic Re: Indexed Events Per Minute in Splunk Search

Indexed Events Per Minute

HeinzWaescher — Wed, 27 Nov 2013 17:01:45 GMT

Hi,

is it possible to write a search, that shows the total count of events by indextime (span=1m)?

Best

Heinz

Re: Indexed Events Per Minute

MuS — Wed, 27 Nov 2013 17:05:47 GMT

Hi HeinzWaescher,

Could it be you are looking for eventcount ?

Cheers, MuS

Re: Indexed Events Per Minute

HeinzWaescher — Wed, 27 Nov 2013 17:08:07 GMT

Hi,

I already had a look at this, but don't know how to achieve me goal with it

Re: Indexed Events Per Minute

MuS — Wed, 27 Nov 2013 17:35:19 GMT

Maybe something like

YourSearch | bucket _indextime span=1m | stats count by _indextime

Re: Indexed Events Per Minute

lukejadamec — Wed, 27 Nov 2013 17:37:58 GMT

Try this: UPDATED with a search that works.

index=main |  eval indexed_time=strftime(_indextime, "%+") | timechart span="1m" count(indexed_time)

Re: Indexed Events Per Minute

lguinn2 — Wed, 27 Nov 2013 17:46:44 GMT

FYI, _indextime=* is unnecessary as all events have the _indextime field

The sort and the table commands are likewise unneeded, as stats already does these functions.

Otherwise, this is fine.

Re: Indexed Events Per Minute

lukejadamec — Wed, 27 Nov 2013 17:58:57 GMT

Thanks, learn something new every day. Also, learned that this search I posted give the wrong results... Updating it now.

Re: Indexed Events Per Minute

HeinzWaescher — Thu, 28 Nov 2013 08:53:28 GMT

Hi,

but this search is using _time and not the indextime, right? And _time is using a timestamp of the event.
So for my purposes the timechart should use the indextime.

Could this be a correct approach?

index=* | rename _indextime AS _time | timechart span=1min count | sort 0 - _time

I get results, but have to option to check them back

Re: Indexed Events Per Minute

MuS — Mon, 28 Sep 2020 15:23:07 GMT

Hi Heinz, now that I'm able to test things I would suggest that you use something like this:

index=* | bucket span=1m _indextime | eval myTime=strftime(_indextime, "%+") | chart count by myTime

timechart uses _time underneeth and with chart you can define 'over' and 'by' clauses.

Re: Indexed Events Per Minute

lukejadamec — Thu, 28 Nov 2013 15:17:53 GMT

I don't think calling _indextime _time is going to change the time used by timechart.
I think what you want to do is extract the minute from the _indextime field, and then count by that minute.

Re: Indexed Events Per Minute

HeinzWaescher — Thu, 28 Nov 2013 17:26:41 GMT

hey,

renaming _time works. just try out a very simple search:

your search | eval _time=now() | timechart count

Re: Indexed Events Per Minute

HeinzWaescher — Thu, 28 Nov 2013 18:14:36 GMT

Hey MuS,

thanks for the new input. This search works fine and gives the same results as the search I tried out earlier:

index=* | rename _indextime AS _time | timechart span=1min count | sort 0 - _time

Re: Indexed Events Per Minute

lukejadamec — Thu, 28 Nov 2013 18:43:37 GMT

Cool, so you're all set then?

Re: Indexed Events Per Minute

ahjmcaleer — Wed, 04 Jan 2017 18:34:04 GMT

I downvoted this post because the link no longer works.

Re: Indexed Events Per Minute

MuS — Wed, 04 Jan 2017 18:44:44 GMT

@ahjmcaleer, down voting a over three years old post is pretty harsh .... but I'm also here to help, so find the most recent link here http://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Eventstats

I'm looking forward for your upvote 😉