topic Summarize data in Splunk Search https://community.splunk.com/t5/Splunk-Search/Summarize-data/m-p/641556#M222245 Mon, 01 May 2023 07:55:09 GMT Kirthika 2023-05-01T07:55:09Z Summarize data https://community.splunk.com/t5/Splunk-Search/Summarize-data/m-p/641556#M222245 Mon, 01 May 2023 07:55:09 GMT https://community.splunk.com/t5/Splunk-Search/Summarize-data/m-p/641556#M222245 Kirthika 2023-05-01T07:55:09Z Re: For one probe, summarize each inspection by calculating the proportion of time spent at articulation level >0.8 r https://community.splunk.com/t5/Splunk-Search/Summarize-data/m-p/641584#M222255 <P>What have you tried so far and how did those results not meet expectations?</P><P>What is the unique identifier of a device?</P> Thu, 27 Apr 2023 12:38:56 GMT https://community.splunk.com/t5/Splunk-Search/Summarize-data/m-p/641584#M222255 richgalloway 2023-04-27T12:38:56Z Re: For one probe, summarize each inspection by calculating the proportion of time spent at articulation level >0.8 r https://community.splunk.com/t5/Splunk-Search/Summarize-data/m-p/641595#M222258 <P>Summarize</P> Mon, 01 May 2023 07:57:15 GMT https://community.splunk.com/t5/Splunk-Search/Summarize-data/m-p/641595#M222258 Kirthika 2023-05-01T07:57:15Z Re: For one probe, summarize each inspection by calculating the proportion of time spent at articulation level >0.8 r https://community.splunk.com/t5/Splunk-Search/Summarize-data/m-p/641623#M222261 <P>How does that query work for you?</P><P>The OP mentioned "probe" and "device" and said there could be more than one probe ID for each device.&nbsp; The example results table shows "Machineid" and "probeid" columns.&nbsp; So, again I ask: What uniquely identifies a device?</P><P>The _time field in Splunk is in Linux epoch form - the number of seconds that have elapsed since 1 Jan 1970.&nbsp; Adding up _time for several devices will produce a total_time value in the hundreds of years, which is unlikely to be correct or even helpful.</P> Thu, 27 Apr 2023 15:31:49 GMT https://community.splunk.com/t5/Splunk-Search/Summarize-data/m-p/641623#M222261 richgalloway 2023-04-27T15:31:49Z Re: For one probe, summarize each inspection by calculating the proportion of time spent at articulation level >0.8 r https://community.splunk.com/t5/Splunk-Search/Summarize-data/m-p/641631#M222263 <P>Hi Richgalloway &nbsp;What you said is correct. Total time value is hundred of years.. How to resolve this issue. Machine ID and Device ID are same. In sample I have mentioned as MachineID. It is unique id. Thanks in Advance</P> Thu, 27 Apr 2023 16:52:02 GMT https://community.splunk.com/t5/Splunk-Search/Summarize-data/m-p/641631#M222263 Kirthika 2023-04-27T16:52:02Z Re: For one probe, summarize each inspection by calculating the proportion of time spent at articulation level >0.8 r https://community.splunk.com/t5/Splunk-Search/Summarize-data/m-p/641654#M222268 <P>We don't have enough data to solve the problem.&nbsp; While we have a time of day of each calculation, we do not have the duration of each calculation.&nbsp; If we have start and end timestamps then we can determine the duration.</P><LI-CODE lang="markup">| eval radius = sqrt(pow(x,2)+pow(y,2)) |where radius &gt; 0.8 |stats sum(duration) as total_time by Machineid |sort 0 total_time</LI-CODE> Thu, 27 Apr 2023 18:49:13 GMT https://community.splunk.com/t5/Splunk-Search/Summarize-data/m-p/641654#M222268 richgalloway 2023-04-27T18:49:13Z