Splunk Enterprise

bucket span not working for lower time span

shashank_24
Path Finder

Hi, I have a search but it doesn't seem to work. I need to extract the transaction per second data and for that I was using timechart but it is restricting the rows with below error -

The specified span would result in too many (>50000) rows.

Then i thought of using bucket command with stats but it doesn't seem to work correctly. It doesn't give me the data per second which is actually my requirement. See the below table for output

index=test sourcetype=ssl_access_combined requested_content="/myapp" 
| bucket span=1s _time 
| stats count by _time

 

_time	count
2020-07-09 00:00:06	1
2020-07-09 00:00:27	1
2020-07-09 00:00:38	1
2020-07-09 00:00:40	1

 

can someone advice on this? I am not sure why it is happening.

Labels (1)
0 Karma

to4kawa
Ultra Champion

sample: try time picker last 7 days

 

 

 

| makeresults [| makeresults  | addinfo | eval count="count=".round(info_max_time - info_min_time) | return $count] | streamstats current=f count | eval _time=_time - count | fields - count
| append [ | tstats count where index=_internal sourcetype=splunkd by _time span=1s]
| fillnull count
| stats max(count) as count by _time

 

 

 

make _time like above. If subsearch result is over 50000, 

| tstats count where index=_internal by _time span=1s
| reverse
| autoregress _time as time
| reverse
| eval time_ex=mvrange(_time,time,1)
| streamstats count as session
| stats values(count) as count by session time_ex
| sort 0 session time
| rename time_ex as _time
| eventstats min(_time) as time by session
| eval count=if(_time=time,count,0)
| fields - session time
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

your syntax/usage with bucket seems to be correct.

For how long time range you try to run this query with timechart?

r. Ismo

0 Karma

shashank_24
Path Finder

@isoutamo I actually needed for longer time like last 7 days which won't work with timechart.

Actually I think i got what's wrong. I was confused about the time gap in the below table but it seems the stats command is only logging the time when there was an event occurred. I was expecting it to work like timechart which shows the every second irrespective of the events occurred

_time	count
2020-07-09 00:00:06	1
2020-07-09 00:00:27	1
2020-07-09 00:00:38	1
2020-07-09 00:00:40	1

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Actually bucket/bin command groups events within 1s slots based on their _time and if there haven’t been any events in some particular seconds then stats couldn’t calculate for it anything.

Maybe those gaps can filled with makeresults and streamstats? Unfortunately I haven’t splunk on my hand now to test this further.

r. Ismo

Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...