Splunk Enterprise

how to time range

nnonm111
Path Finder

index="*"

| stats count by clientip, productId

| stats list(productId) AS productId list(count) AS count by clientip

 

I want to get information that has been released more than 10 times in an hour from the time the log was detected, not the current time standard in the command.

Labels (2)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

I'm not exactly sure what you are wanting, but I think that you should use streamstats to generate count for sliding 1 hour span or eventstats with bin before it to get e.g. exactly one hour spans like 0-1, 1-2 etc.

https://docs.splunk.com/Documentation/Splunk/8.2.2/SearchReference/Streamstats

https://docs.splunk.com/Documentation/Splunk/8.2.2/SearchReference/Eventstats

r. Ismo

0 Karma