topic Re: Error in 'stats' command: The argument 'span=1min' is invalid. in Splunk Search

Error in 'stats' command: The argument 'span=1min' is invalid.

dtapia — Fri, 28 Mar 2025 06:37:02 GMT

Help: when i try to run the following a get Error in 'stats' command: The argument 'span=1min' is invalid.

index=transactions

tipo_transaccion="Retiro de Efectivo"

(emisor="VISA" AND tipo_cuenta="Crédito")

| eval is_authorized=if(codigo_respuesta=="00" OR codigo_respuesta=="000", 1, 0)

| eval is_declined=if(is_authorized==0 AND (codigo_respuesta!="91" AND codigo_respuesta!="68" AND codigo_respuesta!="timeout"), 1, 0)

| eval is_timeout=if(codigo_respuesta=="91" OR codigo_respuesta=="68" OR codigo_respuesta=="timeout", 1, 0)

| stats

count as total_txn,

sum(is_authorized) as authorized_txn,

sum(is_declined) as declined_txn,

sum(is_timeout) as timeout_txn,

sum(eval(is_authorized*importe)) as authorized_amount,

sum(eval(is_declined*importe)) as declined_amount,

sum(eval(is_timeout*importe)) as timeout_amount

by _time span="1min"

Please your support I really don't know what is causing the mistake

regards

Dtapia

Re: Error in 'stats' command: The argument 'span=1min' is invalid.

gcusello — Fri, 28 Mar 2025 06:54:50 GMT

Hi @dtapia ,

as you can ead at https://docs.splunk.com/Documentation/Splunk/9.4.1/SearchReference/Stats you cannot use the span option in the stats command, it's possible to use it only in the tstats or timechart commands but not in stats.

In this case, you have to add a ne command bin or bucket before the ststs command, something like this:

index=transactions tipo_transaccion="Retiro de Efectivo" (emisor="VISA" AND tipo_cuenta="Crédito") | eval is_authorized=if(codigo_respuesta=="00" OR codigo_respuesta=="000", 1, 0) | eval is_declined=if(is_authorized==0 AND (codigo_respuesta!="91" AND codigo_respuesta!="68" AND codigo_respuesta!="timeout"), 1, 0) | eval is_timeout=if(codigo_respuesta=="91" OR codigo_respuesta=="68" OR codigo_respuesta=="timeout", 1, 0) | bin span=1m _time | stats count as total_txn, sum(is_authorized) as authorized_txn, sum(is_declined) as declined_txn, sum(is_timeout) as timeout_txn, sum(eval(is_authorized*importe)) as authorized_amount, sum(eval(is_declined*importe)) as declined_amount, sum(eval(is_timeout*importe)) as timeout_amount by _time

Ciao.

Giuseppe

Re: Error in 'stats' command: The argument 'span=1min' is invalid.

livehybrid — Fri, 28 Mar 2025 09:56:55 GMT

Hi @dtapia

The `stats` command doesnt allow for a span with splitting by _time, instead you should either use timechart (which I believe would work in this case - just replace "stats" for "timechart")

or you could use the `bin` command (`| bin _time span=1min` BEFORE the `stats` command then you can use | stats count..sum...etc.. BY _time (without the span) and it will be in 1 min blocks.

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

Re: Error in 'stats' command: The argument 'span=1min' is invalid.

dtapia — Sat, 29 Mar 2025 02:16:36 GMT

Hello GCusello,

thank you very much for the support, it worked very well

Regards

DTapia

Re: Error in 'stats' command: The argument 'span=1min' is invalid.

dtapia — Sat, 29 Mar 2025 05:27:57 GMT

Hi @livehybrid, thank you so much for your feedback, they were very helpful in getting my Dashboard working in Splunk, thank you

Regards

DTapia

Re: Error in 'stats' command: The argument 'span=1min' is invalid.

gcusello — Sun, 30 Mar 2025 12:36:35 GMT

Hi @dtapia ,

good for you, see next time!

let us know if we can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉