topic Re: Getting the counts in Splunk Search

Getting the counts

xvxt006 — Tue, 29 Sep 2020 06:39:32 GMT

Hi i have this query - sourcetype=access_combined_cookie uri="xxxxx" jsession!=- | bucket _time span=5m | stats count by _time,jsession, | where count > 100

i basically want to get a timechart of count of jsessions for which uri xxxx is executed more than 100 times in 5m period.

i have used timechart but did not work. can you pls help me modify this query.

Re: Getting the counts

woodcock — Fri, 10 Jul 2015 15:08:17 GMT

If I understand you correctly, this should do it (you were almost there):

sourcetype=access_combined_cookie uri="xxxxx" jsession!=- | bucket _time span=5m | stats count BY _time jsession | where count > 100 | timechart span=5m first(count) AS count BY jsession

sourcetype=access_combined_cookie uri="xxxxx" jsession!=- | timechart span=5m count BY jsession | where count>100

Re: Getting the counts

xvxt006 — Fri, 10 Jul 2015 15:25:11 GMT

Hi,
i have tried the timechart one previously but that is not giving me any results. Going back to the first query, after i took out _time, i am getting i think may be the first one for that day. But i need the total count for that day. Also i don't need to show the uri count, but i need the instances count of how many times it exceeded > 100.

Re: Getting the counts

woodcock — Fri, 10 Jul 2015 15:37:57 GMT

Based on this clarification:

I need the total count for that day but I don't need to show the uri count, I need the instances count of how many times it exceeded > 100 (within 5 minutes).

This should work when run for at least 1 full day (or more):

 sourcetype=access_combined_cookie uri="xxxxx" jsession!=- | bucket _time span=5m | stats count BY _time jsession | timechart span=1d count(eval(count>100)) AS count BY jsession

Re: Getting the counts

xvxt006 — Tue, 29 Sep 2020 06:39:34 GMT

Thank you. this is close. But when i just execute - sourcetype=access_combined_cookie uri="xxxxx" jsession!=- | bucket _time span=5m | stats count BY _time jsession | where count > 100

i am getting 27 results but when i use your latest query i see 16 results. trying to find why is the difference

Re: Getting the counts

woodcock — Fri, 10 Jul 2015 15:52:33 GMT

You are probably doing "last 24 hours" instead of "yesterday"; the former splits across 2 days so will show differently between the 2 searches. Run both searches for "yesterday" or "today" and the values will be the same. The former evaluates every 5m interval for the entire timepicker range (regardless of days), the latter breaks out by days.

Re: Getting the counts

xvxt006 — Fri, 10 Jul 2015 15:57:18 GMT

Awesome. Actually this is correct.

Re: Getting the counts

xvxt006 — Fri, 10 Jul 2015 16:05:07 GMT

Thank you