topic Re: How to write one search find the count for three different time frames without using append or multisearch? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-write-one-search-find-the-count-for-three-different-time/m-p/167885#M47831 <P>Can you explain why you have the condition banning <CODE>append</CODE> (and presumably <CODE>appendcols</CODE>) and subsearches?</P> Wed, 29 Apr 2015 07:21:59 GMT rsennett_splunk 2015-04-29T07:21:59Z How to write one search find the count for three different time frames without using append or multisearch? https://community.splunk.com/t5/Splunk-Search/How-to-write-one-search-find-the-count-for-three-different-time/m-p/167884#M47830 <P>Hi, </P> <P>Please help me sort this out.<BR /> I have a single search like <CODE>index=test sourcetype= test...| stats count</CODE>, but the trick here is I have to find the count for <CODE>-30m@m</CODE>, <CODE>-15m@m</CODE> and <CODE>-5m@m</CODE>....and the condition is we shouldn't use append or multisearch..it should run in a single query. </P> <P>the output would look something like below:</P> <PRE><CODE>count(last30min) count(last15min) count(last5m) xxx xxxx xxxxx </CODE></PRE> <P>NOTE: it should run in a single search, no append or multisearch </P> Wed, 29 Apr 2015 06:27:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-one-search-find-the-count-for-three-different-time/m-p/167884#M47830 Venkat_16 2015-04-29T06:27:23Z Re: How to write one search find the count for three different time frames without using append or multisearch? https://community.splunk.com/t5/Splunk-Search/How-to-write-one-search-find-the-count-for-three-different-time/m-p/167885#M47831 <P>Can you explain why you have the condition banning <CODE>append</CODE> (and presumably <CODE>appendcols</CODE>) and subsearches?</P> Wed, 29 Apr 2015 07:21:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-one-search-find-the-count-for-three-different-time/m-p/167885#M47831 rsennett_splunk 2015-04-29T07:21:59Z Re: How to write one search find the count for three different time frames without using append or multisearch? https://community.splunk.com/t5/Splunk-Search/How-to-write-one-search-find-the-count-for-three-different-time/m-p/167886#M47832 <P>Hi,</P> <P>You can create a field which identifies the time frame bucket. e.g.</P> <PRE><CODE>..| eval currentTime=now() | eval timeBucket=if(_time &gt; (currentTime-5mins), "5Mins", next conditions for 15 and 30 mins ) | stats count by timeBucket </CODE></PRE> <P>Note: convert mins in seconds for comparision.</P> <P>Thanks!!</P> Wed, 29 Apr 2015 08:46:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-one-search-find-the-count-for-three-different-time/m-p/167886#M47832 vganjare 2015-04-29T08:46:42Z Re: How to write one search find the count for three different time frames without using append or multisearch? https://community.splunk.com/t5/Splunk-Search/How-to-write-one-search-find-the-count-for-three-different-time/m-p/167887#M47833 <P>The condition was the env we are using can run only 10 concurrent searches and i have already 9 searches in place so thats why we ignored append </P> Fri, 01 May 2015 17:24:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-one-search-find-the-count-for-three-different-time/m-p/167887#M47833 Venkat_16 2015-05-01T17:24:05Z