topic span with stats in Splunk Search

span with stats

vumanhtai — Tue, 29 Sep 2020 17:39:09 GMT

Hi ALL
i have a search
sourcetype="pan:traffic" | eval Byte_IN=bytes_in/1024/1024/1024 | eval Byte_OUT=bytes_out/1024/1024/1024 |eval SumByte=bytes/1024/1024/1024 | stats sum(Byte_IN) AS GB_IN ,sum(Byte_OUT) AS GB_OUT ,sum(SumByte) AS Sum_GB

i want span=1s
how can do that

Re: span with stats

mayurr98 — Mon, 15 Jan 2018 04:47:52 GMT

Hey you can use timechart command

sourcetype="pan:traffic" | eval Byte_IN=bytes_in/1024/1024/1024 | eval Byte_OUT=bytes_out/1024/1024/1024 |eval SumByte=bytes/1024/1024/1024 | timechart span=1s sum(Byte_IN) AS GB_IN ,sum(Byte_OUT) AS GB_OUT ,sum(SumByte) AS Sum_GB

Let me know if this helps you!

Re: span with stats

micahkemp — Mon, 15 Jan 2018 04:55:18 GMT

There are multiple options. The first of which is timechart, as @mayurr98 posted above. The other, which you seem to have specifically asked about, is to do stats BY _time, where you have previously performed bin against _time:

sourcetype="pan:traffic" | eval Byte_IN=bytes_in/1024/1024/1024 | eval Byte_OUT=bytes_out/1024/1024/1024 |eval SumByte=bytes/1024/1024/1024 | bin span=1min _time | stats sum(Byte_IN) AS GB_IN ,sum(Byte_OUT) AS GB_OUT ,sum(SumByte) AS Sum_GB BY _time

Which of these is most appropriate depends on your specific use case, pick the style that gives you the type of results that work best for you.

Re: span with stats

vumanhtai — Mon, 15 Jan 2018 05:54:45 GMT

oh! yeah
thank you so much