Deployment Architecture

bucket _time produce extra count result


I was trying to compare events from the last two days respectively (and it should be last 24 hours instead of the day before 00:00) I used bucket _time to get the count result from each two day by setting time range in the search box as Last 2 days. However, the count produced have three results instead of 2:

| *** base search ***
| bucket _time span=24h
| stats count by _time

Here's my result:

_time                              count
2019-03-18 08:00          1
2019-03-19 08:00          11
2019-03-20 08:00          15

But the correct result should be:

_time                           count
2019-03-19 08:00            12
2019-03-20 08:00            15

Does anyone know what's the problem? Thank you so much for the help!

0 Karma


Right now my workaround solution is using eval:

| eval _time = _time -28800
| bucket _time span=24h
| eval _time = _time +28800
| stats count by _time

Because I checked the only event on 18th is on 8 AM but I wonder if there's any better solution?

0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...