Splunk Dev

Getting the count based on the keywords on the events

macadminrohit
Contributor

Hi,

I am trying to get the timechart span = 1h , for the APIs appearing in the events. search query is like this ?

index=home sourcetype=logs "Keyword" | timechart count span=1h as count | sort _time | reverse

there will be different keyword but the underline search will be different like keyword1, keyword2, keyword3 etc, I want to get the timechart by each keyword. how that can be done.

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Are the kewords fixed values? If yes, try this

index=home sourcetype=logs "keyword1" OR "keyword2" OR "keyword3"....
| eval keyword=case(searchmatch("keyword1"),"Keyword1", searchmatch("keyword2"),"Keyword2",.....rest of the keywords)
| timechart count span=1h as count by keyword | reverse

View solution in original post

0 Karma

somesoni2
Revered Legend

Are the kewords fixed values? If yes, try this

index=home sourcetype=logs "keyword1" OR "keyword2" OR "keyword3"....
| eval keyword=case(searchmatch("keyword1"),"Keyword1", searchmatch("keyword2"),"Keyword2",.....rest of the keywords)
| timechart count span=1h as count by keyword | reverse
0 Karma

macadminrohit
Contributor

Thanks Somesh, it works. I want to accept this as answer but not getting that option.

0 Karma

somesoni2
Revered Legend

Here you go.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...