I have some building occupancy data generated from our wireless network that is logged as one record per floor of each building every 5 minutes.
I'm now trying to export a spreadsheet to another user who has requested a 15 minute resolution of this data. I believe I'm looking for a WHERE clause where the minutes of _time for the event fall within a set of ranges. The data isn't aligned to the clock very well so the first record could be in minute 0 to minute 5, so second would need to be 10-15, etc. But my skill level with using these functions is falling short here. 🙂
You can specify a sampling ratio of 3 by activating event sampling for your search in Splunk Web.
If you 'd like it to be more widely applied, specify the value in
ui-prefs.conf. More details could be found in Splunk Docs.
However this seems to assume that my data is ordered nicely and have it fall nicely on the 1/3 boundary. It's imported from a CSV which is output from another system that orders things oddly and this approach seems to mangle my data.
If I try to sort the data I'm limited to 10,000 of the ~75,000 rows I need
In this case you can do some manual filtering in the query to return events from certain times, e.g., only the events that landed on 0th, 15th, 30th or 45th minutes of any given hour. An example is below:
index=_internal | eval eventMin=strftime(_time,"%M") | table _time, eventMin | search (eventMin=0 OR eventMinute=15 OR eventMinute=30 OR eventMinute=45)
of course, you can adjust the value of
eventMinute to whatever you see fit.
| bin span=5min _time
bin to aggregate on each time span.
| timechart span=15min count
timechart can be aggregated on any time span.
If you only count the event, here is fastest way:
| tstats count where index=your sourcetype=yours by _time span=15min