topic Re: How to sum the values in a field over a specific time span? in Splunk Search

How to sum the values in a field over a specific time span?

chatham — Fri, 19 Sep 2014 17:27:07 GMT

New to splunk!

I'm currently having trouble trying to sum values in a field over a specific time span...

My search:

*HttpRequestProcessor | rex field=LogLine "(?<Time>\s\d+\s)" | rex field=TimeStamp_Thread "(?<dt2>[\d]{4}-[\d]{2}-[\d]{2} [\d]{1,2}:[\d]{1,2}[\d]{1,2}:[\d]{2}.[\d]{3})"  | convert num(Time)    | eval time5=strptime(dt2,"%Y-%m-%d %H")  | eval _time=time5  | bucket _time span=1h | stats count(Time) by _time

instead of count(Time) what I really want is sum(Time) however, when I use that syntax, no stats are returned...what am I missing here?

Thanks!

Re: How to sum the values in a field over a specific time span?

sk314 — Fri, 19 Sep 2014 17:40:31 GMT

As extracted by your regex, Time has spaces in it. May be that's why sum fails.

Try this instead:

 *HttpRequestProcessor | rex field=LogLine "\s(?<Time>\d+)\s" | rex field=TimeStamp_Thread "(?<dt2>[\d]{4}-[\d]{2}-[\d]{2} [\d]{1,2}:[\d]{1,2}[\d]{1,2}:[\d]{2}.[\d]{3})"  | convert num(Time)    | eval time5=strptime(dt2,"%Y-%m-%d %H")  | eval _time=time5  | bucket _time span=1h | stats sum(Time) by _time

Re: How to sum the values in a field over a specific time span?

chatham — Fri, 19 Sep 2014 17:46:52 GMT

Genius! That worked! Thanks a lot, sk314!