topic Re: How do I sum by strftime day? in Splunk Search

How do I sum by strftime day?

timmoammo — Mon, 28 Sep 2020 13:16:22 GMT

Hello,

A simple questions I think.......

I'm moving my _time by 6 hours and creating newTime then using strftime to look at the results.

I then want to sum GJ by day of the newTime/strftime and then find the max of this?

This is the part of the search that isn't working

eval newTime = relative_time(_time, "-6h")

| eval n=strftime(newTime , "%Y/%m/%d-%T")
| stats sum(GJ) as MaxDay BY n_day

Any help is appreciated

lguinn2 — Fri, 08 Feb 2013 07:19:23 GMT

Try this - just use n instead of n_day

eval newTime = relative_time(_time, "-6h")
...
| eval n=strftime(newTime , "%Y/%m/%d-%T") 
| stats sum(GJ) as MaxDay BY n

timmoammo — Mon, 11 Feb 2013 05:53:55 GMT

Thanks for response however this doesn't seem to work.

The bit I'm struggling with is summing by day in the adjusted strftime.

i.e. I want to sum the GJ by day (in STRFtime) and then get the max of this