topic Show count by a field value in Splunk Search

Show count by a field value

Karthikeyan — Thu, 19 Aug 2021 12:34:57 GMT

Hi Experts,

I have a requirement to in which a table is ingested to Splunk. And the table has a field named Time showing timestamp as "YYYY-MM-DD HH:MM:SS:milisec". Data ingestion is happening without any issues. When I tried to show the count of events in a particular day

1. With stats command, the count is is matching with source, but there are times when there is no event happens in source system and that day count is not showing as 0 in Splunk, its just ignored.

2. With time command, Splunk takes the ingested timestamp of the event and not the timestamp in the event, and the count is not matching. Whereas, here when there is no data gets ingested, the count is showing as 0.

Please help me with this issue, where the count should be calculated with the field Time and in case if there is no event for a day, that should get displayed as 0. I'm trying to show the data in a bar chart.

Any help is much appreciated. Thanks.

Regards, Karthikeyan.SV

Re: Show count by a field value

richgalloway — Thu, 19 Aug 2021 23:57:40 GMT

The stats command counts events. If data from a certain source is absent then it is not counted.

The timechart command also counts events, but will automatically (unless told otherwise) fill in zeroes for time periods with no data. Again, if a source is completely absent then it cannot be counted.

The timechart command requires the _time field for it to work. You can, however, set _time to any other field you have.

... | eval _time=Time | timechart count by source

Re: Show count by a field value

Karthikeyan — Fri, 20 Aug 2021 13:16:50 GMT

Hi,

We use below search query to find the count

index="index" sourcetype="source_events"
| eval time=strptime(TIME,"%Y-%m-%d %H:%M:%S.%Q")
| eval date = strftime(time,"%Y-%m-%d")
|timechart span=1d count(date)

When I tried with the provided search command, didn't get the output.

Re: Show count by a field value

Karthikeyan — Fri, 20 Aug 2021 13:27:31 GMT

Since this is ingested as a table, no new source are generated and hence we could see not count values. Apart from time field, there are other unique fields such as EXECUTION_HASH, EXECUTION_ID, with which I tried to do a count, but couldn't get desired result.

Search query:
| eval _time=TIME
| timechart count by EXECUTION_ID