Deployment Architecture

how to create bucket over a period of 3 days?


Hello Folks,

We're trying to set up an alert for user contacting malware websites constantly. For eg user A attempts to access "malware" category website on day 1, day 2 and day 3, if it has happened on all 3 days then should be flagged.

Base search:
index=proxy url=* category="malware"

Tried to add below after the base seach but doesn't seem to be creating 3 buckets.
| bin _time bins=3 | stats count by _time

Any help or pointers?

Thanks in advance!!

Tags (1)
0 Karma


Are you looking for this?

maxHotSpanSecs =
* Upper bound of timespan of hot/warm buckets in seconds.

maxHotSpanSecs = 259200

0 Karma


Hi ,

I have not tried this one yet , but i got some answers for this same issue

You can't set a time retention on hot or warm buckets. Only by size in MB. This is one of my huge gripes in Splunk.
You can use the Monitoring Console to gain some insight into how much data is in your hot/warm directories (x amount of days, for instance). The only time retention I've found is based on moving data from cold into frozen

Link to the original answer :

0 Karma


Thanks for your reply.

Not sure if I aksed question correctly. Our aim is to get 3 bins when we execute splunk search and if it matches the criteria.


0 Karma


Below query seems to be giving me answer nearly what we after

index=proxy logs url=* category="malware" | bucket _time span=24h | stats count by _time,user

Results are something like this when I run for 2 days:

_time user count
2018-10-24 10:00 A 1
2018-10-24 10:00 B 11
2018-10-24 10:00 C 3
2018-10-25 10:00 A 1
2018-10-25 10:00 D 9
2018-10-25 10:00 E 10

Now, as we can see that user A has appeared twice in the search, is there a way to display the results only for user A and filter out rest?


0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...