Getting Data In
Highlighted

Regroup Splunk events with almost similar _time

Path Finder

Hello all,

Every 10 seconds, I send a bunch of events to Splunk.
I need to count how many events I receive every 10 sec but I can't get the real number because of the fact that Splunk doesn't regroup them together if their time is even slightly different.

Very simple example :

10 : 00 : 10.052 Hello Splunk!
10 : 00 : 10.052 Hello Splunk!
10 : 00 : 10.054 Hello Splunk!
10 : 00 : 10.054 Hello Splunk!

10 : 00 : 20.052 Hello Splunk!
10 : 00 : 20.052 Hello Splunk!
10 : 00 : 20.055 Hello Splunk!

Splunk would regroup those events into 4 groups (events at 10.052 , 10.054, 20.052, 20.055) instead of 2 groups (events at 10.50 and at 20.50 for example).

For such an example, I would like to get something like :
10 : 00 : 10.00 -> 4 Hello Splunk
10 : 00 : 20.00 -> 3 Hello Splunk

Is there a workaround to that ?

Thank you.

0 Karma
Highlighted

Re: Regroup Splunk events with almost similar _time

try using timechart with span=10sec

i.e. |timechart count span=10s

Highlighted

Re: Regroup Splunk events with almost similar _time

Path Finder

Completly forgot about timechart omg! Thank you, doing it atm

0 Karma
Highlighted

Re: Regroup Splunk events with almost similar _time

Path Finder

Yeah simple as that. Should have thought about that, haven't used Splunk in quite a while. Thank you.

0 Karma
Highlighted

Re: Regroup Splunk events with almost similar _time

Path Finder

See vishaltaneja07011993's answer.

View solution in original post

0 Karma
Highlighted

Re: Regroup Splunk events with almost similar _time

@Zakary_n

Thank you 🙂

0 Karma