topic Search results help in getting hourly results? in Splunk Search

Search results help in getting hourly results?

kc_prane — Mon, 08 May 2023 10:00:31 GMT

Hi I am using the below query and i need the results in hourly basis for the time i selected ?

"My Base search" | fields TRAN_TIME_MS PAGE_ID PAGE_TITLE _time| eventstats perc99(TRAN_TIME_MS) as Percentile by PAGE_ID | where TRAN_TIME_MS <= Percentile | stats count avg(TRAN_TIME_MS) as avg_time max(TRAN_TIME_MS) as max_time by PAGE_ID,PAGE_TITLE, | eval avg_time=round(avg_time/1000,2) | eval max_time=round(max_time/1000,2)
| rename count as Total_Requests avg_time as Average(Seconds) max_time as Max_Time(Seconds) PAGE_ID as Page_ID PAGE_TITLE as Page_Description

Re: Search results help in getting hourly results .

richgalloway — Fri, 05 May 2023 20:08:25 GMT

To get the results broken down by hour, first use the bucket command to group results into the hour they occur. Then add _time as a group in the stats command.

"My Base search" | fields TRAN_TIME_MS PAGE_ID PAGE_TITLE _time | eventstats perc99(TRAN_TIME_MS) as Percentile by PAGE_ID | where TRAN_TIME_MS <= Percentile | bucket span=1h _time | stats count avg(TRAN_TIME_MS) as avg_time max(TRAN_TIME_MS) as max_time by _time, PAGE_ID,PAGE_TITLE, | eval avg_time=round(avg_time/1000,2) | eval max_time=round(max_time/1000,2) | rename count as Total_Requests avg_time as Average(Seconds) max_time as Max_Time(Seconds) PAGE_ID as Page_ID PAGE_TITLE as Page_Description

Re: Search results help in getting hourly results .

kc_prane — Fri, 05 May 2023 20:17:09 GMT

Thanks @richgalloway this Helps.