Splunk Search

Event sampling with specific event gaps for multiple hosts

AshimaE
Explorer

I have multiple hosts in my result table and there is no specific sampling interval for each. However it is sure that in every host there are events at every 15 minutes though there can be variable number/ time of other events in between. How do I select the 15 minutes events from every host separately since I have to take the stats of the fields for every host separately.

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

You can use this:

... | bin _time span=15m

This will round all events down to the nearest 15-minute boundary. Now you can do your other magic.

View solution in original post

0 Karma

woodcock
Esteemed Legend

You can use this:

... | bin _time span=15m

This will round all events down to the nearest 15-minute boundary. Now you can do your other magic.

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

If you want to average the samples in every 15m interval
...
| bin _time span=15m
| stats avg(Value) as Value by _time host

If you want the first event out of every 15 minute interval and you know there will always be one...
...
| bin _time as Time span=15m
| stats earliest(Value) as Value by Time host

0 Karma

rjthibod
Champion

Can you share some of your SPL query and/or raw data? I am having a difficult time understanding what exactly you mean.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...