I am having a bit of difficulty understanding what does bin _time span does here. Below is query shared in splunk community to find request per min by OrgName per day
index=data earliest = -1d| bin _time span=1d
| streamstats count as Req by OrgName, _time
| eval requestsPerMin=Req/24/60
| eval requestsPerSec=requestsPerMin/60
| stats avg(requestsPerMin) as avgRequestPerSec, max(requestsPerMin) as peakRequestPerMin by OrgName, _time
My confusion here is what bin _time span does. I want to find requestPerMin for Last week and month wise too. Could you someone explain how it can be done?
With bin _time span you force the _time to be a full day.
So with | bin _time span=1d you get your stats count split by day.
It you want a report it over a week, just do span=1w a moth is span=1mon (do also change the earlies= value )
View solution in original post