Dashboards & Visualizations

Summary row listing minimum value

adent
Explorer

I am trying to get individual values and add a summary row with the minimum value. In this case I have 3 times and want the output to have all three times and create a minimum time row (labelname=min).

event    _time

a          10:00

b           11:00
c            10:30

min    10:00

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| appendpipe
  [| stats min(_time) as _time
  | eval event="min"]
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @adent,

Only one question, if you have events in more days, an event at previous day 23.59 is earlier than an event at second day 1.30, but calculatig min on the time value it's different.

Do you want to calculate min only on time or the earliest timestamp? 

If min on time, you should run something like this:

<your_search>
| eval Time=strftime(_time,"%H.%M")
| stats min(Time) AS Time BY event
| append [ search <your_search> | eval Time=strftime(_time,"%H.%M") | stats min(Time) AS Time
| eval Time=strftime(Time,"%H.%M")

if the earliest timestamp, you could try something like this:

<your_search>
| stats earliest(_time) AS Time BY event
| append [ search <your_search> | stats earlieste() AS _time
| eval _time=strftime(_time,"%Y-%m-%d %H.%M")

I could be more detailed if you share a sample of your logs and (if you already have) a search that you're using?

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...