Building for the Splunk Platform

How do you use the stats command on a timechart output?

asharm65
New Member

Hi,

i wanted to calculate a count for every 1 sec period and then find the max of the count per day.

i have calculated the count using timechart function.Using query below:

1)..base_query|timechart span=1s count(field_1) as c by field_2

The output of the above query gives a count every 1 second.

Now to calculate the max of count per day. i tried using stats:

2)..base_query|timechart span=1s count(field_1) as c by field_2|stats max(c) by Date

But, the 2nd query does not give desired output.

Thanks in Advance!!!

Tags (1)
0 Karma

FrankVl
Ultra Champion

Where do you get that by Date from? That Date field doesn't exist (at least not given the exact query you are showing here).

If you want to get the max per-second-count by day, try it like this:

...base_query
| timechart span=1s count(field_1) as c by field_2
| bin _time span=1d
| stats max(c) by _time
0 Karma

asharm65
New Member

This does not give any output

0 Karma

FrankVl
Ultra Champion

Can you share the actual search you are running which doesn't give output and / or a screenshot of the situation?

0 Karma
Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...