Splunk Dev

Getting the count based on the keywords on the events

macadminrohit
Contributor

Hi,

I am trying to get the timechart span = 1h , for the APIs appearing in the events. search query is like this ?

index=home sourcetype=logs "Keyword" | timechart count span=1h as count | sort _time | reverse

there will be different keyword but the underline search will be different like keyword1, keyword2, keyword3 etc, I want to get the timechart by each keyword. how that can be done.

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Are the kewords fixed values? If yes, try this

index=home sourcetype=logs "keyword1" OR "keyword2" OR "keyword3"....
| eval keyword=case(searchmatch("keyword1"),"Keyword1", searchmatch("keyword2"),"Keyword2",.....rest of the keywords)
| timechart count span=1h as count by keyword | reverse

View solution in original post

0 Karma

somesoni2
Revered Legend

Are the kewords fixed values? If yes, try this

index=home sourcetype=logs "keyword1" OR "keyword2" OR "keyword3"....
| eval keyword=case(searchmatch("keyword1"),"Keyword1", searchmatch("keyword2"),"Keyword2",.....rest of the keywords)
| timechart count span=1h as count by keyword | reverse
0 Karma

macadminrohit
Contributor

Thanks Somesh, it works. I want to accept this as answer but not getting that option.

0 Karma

somesoni2
Revered Legend

Here you go.

0 Karma
Get Updates on the Splunk Community!

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...