topic How to count IDs that are in the range between current_time and end_time for each second? in Splunk Search

How to count IDs that are in the range between current_time and end_time for each second?

diavolo — Tue, 29 Sep 2020 12:31:49 GMT

I want to count up IDs which are in the range between current_time and end_time for each second.
For example, as for the following data source table, count 1 during 13:17:44 - 13:18:17 only for id: 1cf789ef, then count 2 during 13:18:17 - 13:18:21 for id: 1cf789ef and 3c05282c. Then I want it to be line chart.

Output should look like...

How do I achieve this?

Re: How to count IDs that are in the range between current_time and end_time for each second?

lquinn — Tue, 24 Jan 2017 05:45:15 GMT

If a line chart is the end goal, you could use concurrency to find the number of overlapping events, along with gentimes to create an event for every second. You will need to adjust the parameters of gentimes depending on the time you want your graph to show. This will not however list each individual id, only a count of the number of id's. Try the following search:

<your_current_search> | table id, current_time, end_time | eval starttime=strptime(current_time,"%Y/%m/%d %H:%M:%S") | eval endtime=strptime(end_time,"%Y/%m/%d %H:%M:%S") | eval duration = endtime-starttime | append [|gentimes start=01/21/2017:13:00:00 end=01/21/2017:15:00:00 increment=1s | eval type="gentimes" | eval duration=1] | concurrency start=starttime duration=duration | where type="gentimes" | eval concurrency=concurrency-1 | rename starttime AS _time | timechart span=1s max(concurrency) AS "Number of Id's"

Re: How to count IDs that are in the range between current_time and end_time for each second?

woodcock — Tue, 24 Jan 2017 05:47:33 GMT

You need the concurrency command:

https://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Concurrency

Re: How to count IDs that are in the range between current_time and end_time for each second?

diavolo — Tue, 24 Jan 2017 07:18:05 GMT

Great!!! This is exactly what I wanted.
Thank you!

Re: How to count IDs that are in the range between current_time and end_time for each second?

diavolo — Tue, 24 Jan 2017 07:18:33 GMT

Thank you! I didn't know concurrency command. Very useful!!