topic Re: How do I group time values together by another field? in Splunk Search

How do I group time values together by another field?

andrewking1116 — Sat, 04 Jun 2016 00:15:38 GMT

I'm trying to get my table to group events by Source IP. The search counts the number web traffic hits by Source IP and groups them into 1 hour time frame. I want to then have each Source IP as a single event and also show all the hour time spans that that IP was seen.

Current:

Time               Count   IP             
2016-06-02 14:00   3500    1.1.1.1      
2016-06-02 16:00   3000    1.1.1.1      
2016-06-02 15:00   3000    2.2.2.2

What I want:

Time               Count   IP
2016-06-02 14:00   6500 1.1.1.1      
2016-06-02 16:00
2016-06-02 15:00   3000    2.2.2.2

Re: How do I group time values together by another field?

sundareshr — Sat, 04 Jun 2016 03:46:54 GMT

Try this

... | bin span=1d _time | stats values(_time) as Time sum(count) count by IP | table Time count IP

Re: How do I group time values together by another field?

andrewking1116 — Tue, 07 Jun 2016 21:07:16 GMT

Thank you for your quick response. I thought I had tried that but must have use value instead of values.

Re: How do I group time values together by another field?

ppablo — Wed, 08 Jun 2016 01:13:25 GMT

HI @andrewking1116

If @sundareshr's answer solved your question, please don't forget to resolve the post by clicking "Accept" directly below his answer. Also give him an upvote for helping you out 🙂

Patrick