Splunk Dev

Getting the count based on the keywords on the events

macadminrohit
Contributor

Hi,

I am trying to get the timechart span = 1h , for the APIs appearing in the events. search query is like this ?

index=home sourcetype=logs "Keyword" | timechart count span=1h as count | sort _time | reverse

there will be different keyword but the underline search will be different like keyword1, keyword2, keyword3 etc, I want to get the timechart by each keyword. how that can be done.

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Are the kewords fixed values? If yes, try this

index=home sourcetype=logs "keyword1" OR "keyword2" OR "keyword3"....
| eval keyword=case(searchmatch("keyword1"),"Keyword1", searchmatch("keyword2"),"Keyword2",.....rest of the keywords)
| timechart count span=1h as count by keyword | reverse

View solution in original post

0 Karma

somesoni2
Revered Legend

Are the kewords fixed values? If yes, try this

index=home sourcetype=logs "keyword1" OR "keyword2" OR "keyword3"....
| eval keyword=case(searchmatch("keyword1"),"Keyword1", searchmatch("keyword2"),"Keyword2",.....rest of the keywords)
| timechart count span=1h as count by keyword | reverse
0 Karma

macadminrohit
Contributor

Thanks Somesh, it works. I want to accept this as answer but not getting that option.

0 Karma

somesoni2
Revered Legend

Here you go.

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...