Deployment Architecture

Generate buckets between earliest and latest

gschmitz
Path Finder

Hi all,

I'm looking for something like seq for times in Splunk.

One example:

|seq from=now to=1d span=4h

would generate events with _time as

  • [now+ 0h]
  • [now+ 4h]
  • [now+ 8h]
  • [now+12h]
  • [now+16h]
  • [now+20h]
  • [now+24h]

Do you know of a way to achieve this behavior? bucket and bin work similar, but need a start and end event. That's why the next best thing I could build was

|stats count | fields - count |eval _time=now()-7*24*3600 |append [|stats count | fields - count |eval _time=now()+21*24*3600] | bucket _time span=4h |makecontinuous _time span=4h

which is not very nice to look at and only approximately what I wanted (start and end don't exactly match).

1 Solution

gschmitz
Path Finder

Gentimes. Another hour wasted which Splunk already spent for me 😄

http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/Gentimes

View solution in original post

gschmitz
Path Finder

Gentimes. Another hour wasted which Splunk already spent for me 😄

http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/Gentimes

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...