topic Re: Stats count by hourly trend list in Splunk Search

How to write Stats count by hourly trend list?

corehan — Mon, 11 Apr 2022 15:39:34 GMT

Hello dears,

Can i list search result with stat count like hourly trend ?

Example;

Hour : 00:00 EventCount: 10

Hour : 01:00 EventCount: 15

Hour : 02:00 EventCount: 23

Hour : 23:00 EventCount : 127

Regards.

Re: Stats count by hourly trend list

bowesmana — Mon, 11 Apr 2022 06:34:00 GMT

You can make trend lines on this sort of data. Are you looking to display a timechart and a trend or how do you want to visualise it?

This is an example that calcualates 24 randomly increasing values and then calculates the rolling 8 hour average trend and plots two lines on a line chart.

It uses streamstats to do the trend calculation

Re: Stats count by hourly trend list

corehan — Mon, 11 Apr 2022 06:56:31 GMT

I'm creating a report ( save as search results as a Report) and scheduling "send mail" like inline table, if it not possible may be attached file fine for me.

Regards.

Re: Stats count by hourly trend list

bowesmana — Mon, 11 Apr 2022 23:06:12 GMT

So, if you want to show a table with a trend, how do you want to represent your trend? The example I gave shows you a trend of a rolling 8 hour average - you could use that or adjust it to your use case.

Re: Stats count by hourly trend list

corehan — Mon, 11 Apr 2022 23:13:26 GMT

I want count events for each hour so i need the show hourly trend in table view. Regards.

Re: Stats count by hourly trend list

bowesmana — Tue, 12 Apr 2022 00:04:50 GMT

so, following on from your example data

Hour : 00:00 EventCount: 10 Hour : 01:00 EventCount: 15 Hour : 02:00 EventCount: 23 . . Hour : 23:00 EventCount : 127

do you want the 'trend' for 01:00 to show the difference (+5) to the previous hour and the same for 02:00 (+8) or as a percentage?

Anyway to simply calculate hourly differences, use any of

delta
autoregress
streamstats (as in my example)