topic Re: Timechart or stats or lastTime in Splunk Search

Timechart or stats or lastTime

asarolkar — Tue, 10 Jul 2012 17:59:59 GMT

When I execute this search, I get all events from organization : Barclays that contains records for 2012.

index="log" | search orgName="org\\barclays" | search "*2012*"

However, i want to do two things:

i) graph the number of calls made into a report
ii) find the timestamp for the last event.

I want to be able to do both without using report builder.

Any pointers on how to proceed with this ?

Re: Timechart or stats or lastTime

Ayn — Tue, 10 Jul 2012 18:11:23 GMT

First of all, you don't need to split that up into multiple searches. Rather you'll get worse performance if you do that compared to if use one single search instead.

index="log" orgName="org\\barclays" "*2012*"

Regarding your questions, you need to clarify i) a bit more. How do you count the number of calls? Is that the same as the number of events? Also how do you want to graph it? Over time, split by host, ...

ii)

index="log" orgName="org\\barclays" "*2012*" | stats first(_time)

UPDATE: As for i):

index="log" orgName="org\\barclays" "*2012*" | timechart count by orgName

Re: Timechart or stats or lastTime

asarolkar — Tue, 10 Jul 2012 18:31:21 GMT

The number of calls IS the same as number of events.

I want to graph is by time and then orgName

Re: Timechart or stats or lastTime

asarolkar — Tue, 10 Jul 2012 18:34:38 GMT

Guys: i want to simply chart the events over time without using the Report builder. Any ideas on how to go about it ?

Re: Timechart or stats or lastTime

Ayn — Tue, 10 Jul 2012 18:34:53 GMT

Updated my answer.