Getting Data In

How to combine events which got generated in a specific span?

kranthimutyala
Path Finder

Hi Team,

Im trying to combine events which are generated in a specific span of 1hr and show the count as 1 instead of the actual count. I tried with a bucket and its clubbing them the count is still not coming to 1.
Irrespective of how many events has been geenrated for a specific condition in a span of 1hr I want to keep it as count 1. Can someone help on how to achieve this .Thanks

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please share the search you have tried to solve this, preferably in a code block (use the </> formatting button)

0 Karma

kranthimutyala
Path Finder

index = abc Environment = "PROD" ProcessName = "*"  LogType = "*" TaskName = "*Main*" (LogLevel=ERROR OR LogLevel=FATAL) | bucket _time span=2h |stats count by _time TaskName

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Your stats command is counting the events in the pipeline and creating stats events - try counting these stats events with the same by clause

index = abc Environment = "PROD" ProcessName = "*"  LogType = "*" TaskName = "*Main*" (LogLevel=ERROR OR LogLevel=FATAL) | bucket _time span=2h |stats count by _time TaskName |stats count by _time TaskName
0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...