Splunk Search

Bucket:ed stats

carlpett
Engager

Our error logs are indexed by splunk, and I would like to pull some statistics from this. I want something like an aggregated count from each log source, bucket:ed into say 10 minute intervals, reported by the last 60 minutes.

For instance, something like this

Logging source | 60 minutes | 50 minutes | 40 minutes | 30 minutes | 20 minutes | 10 minutes
Method 1       | 5          | 6          | 10         | 2          | 4          | 8
Method 2       | 7          | 2          | 0          | 3          | 1          | 4
Method 3       | 51         | 30         | 34         | 62         | 41         | 28

I can't quite get my head around how to formulate this query though. I tried this:

index=...etc... | bucket _time span=10m | stats count by _time,LogSource | table count, LogSource, _time

Which is sort of "transposed" from what I really want, it's formatted like this instead:

_time                  | Count | LogSource 
2/7/13 9:50:00.000 AM  | 4     | Method 1
2/7/13 9:20:00.000 AM  | 10    | Method 1
2/7/13 9:20:00.000 AM  | 34    | Method 3
2/7/13 9:40:00.000 AM  | 2     | Method 2
2/7/13 10:00:00.000 AM | 8     | Method 1
2/7/13 9:40:00.000 AM  | 30    | Method 3

How can I turn this into the query I want?

Tags (3)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Try this instead of your stats | table:

... | chart count over LogSource by _time

To get the X minutes you may want to eval yourself a new field with the time differences.

View solution in original post

Paolo_Prigione
Builder

You can transpose such results with "xyseries", but probably you will have to transform the _time column to something ad-hoc. E.g.

index=...etc... 
| bucket _time span=10m 
| stats count by _time, LogSource 
| table count, LogSource, _time
| convert(_time) as time timeformat="%H_%M"
| xyseries LogSource time count
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Try this instead of your stats | table:

... | chart count over LogSource by _time

To get the X minutes you may want to eval yourself a new field with the time differences.

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...