topic Re: Tstats command with span in Splunk Search

Tstats command with span

Harikiranjammul — Wed, 07 May 2025 03:08:05 GMT

I am running tstats command with span of 2hrs for index and source.

It returns the data for every 2hrs.

But I want to include the results only if it's available for every 2hrs in last 24hrs search.

So basically which is not having continuous data, want to ignore it.

How can I do this.

Re: Tstats command with span

bowesmana — Wed, 07 May 2025 03:26:42 GMT

Is this the sort of thing you are looking for?

| tstats count by index source _time span=2h | stats list(count) as counts dc(_time) as frequency list(_time) as times by index source | where frequency>=12

Re: Tstats command with span

Harikiranjammul — Wed, 07 May 2025 03:33:58 GMT

Thanks. Probably this helps

Re: Tstats command with span

kiran_panchavat — Wed, 07 May 2025 03:35:59 GMT

@Harikiranjammul

Re: Tstats command with span

livehybrid — Wed, 07 May 2025 06:41:02 GMT

Hi @Harikiranjammul

Edit - I see there have been other posts since I opened this thread but hopeful;ly this helps someone in the future or provides another option!

How about the following?

| tstats count WHERE earliest=-24h@h latest=@h index=* AND source=* BY _time span=2h, index, source | stats dc(_time) as num_buckets BY index, source |where num_buckets = 12

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing