Splunk Enterprise

how to time range

nnonm111
Path Finder

index="*"

| stats count by clientip, productId

| stats list(productId) AS productId list(count) AS count by clientip

 

I want to get information that has been released more than 10 times in an hour from the time the log was detected, not the current time standard in the command.

Labels (2)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

I'm not exactly sure what you are wanting, but I think that you should use streamstats to generate count for sliding 1 hour span or eventstats with bin before it to get e.g. exactly one hour spans like 0-1, 1-2 etc.

https://docs.splunk.com/Documentation/Splunk/8.2.2/SearchReference/Streamstats

https://docs.splunk.com/Documentation/Splunk/8.2.2/SearchReference/Eventstats

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...