Splunk Search

Count Events, Group by date field

hogan24
Path Finder

I have data that looks like this that I'm pulling from a db. Each row is pulling in as one event:
trxn_id create_dt_tm
123456 2013-11-22 11:01:22.xxx
123457 2013-11-22 11:01:23.xxx
123458 2013-11-22 11:01:24.xxx
123459 2013-11-22 11:02:22.xxx
123460 2013-11-22 11:02:22.xxx

I'd like the results to look like this in a timechart:
Time Count
2013-11-22 11:01 3
2013-11-22 11:02 2
etc

When I do something like this below, I'm getting the results in minute but they are grouped by the time in which they were indexed.
"index=main | timechart count(edi_trxn_detail_id) span=1m"

How do I tell splunk to group by the create_dt_tm of the transaction and subsequently by minute? Thanks.

0 Karma
1 Solution

hogan24
Path Finder

I think I may have figured this one out through suggestions and trial and error...

create_dt_tm | convert timeformat="%m/%d/%y %H:%M" ctime(create_dt_tm) as Minute | stats count as "Transactions" by Minute

This gives me the following which is what I was looking for. Thanks to those who helped!
Minute Transactions
11/24/13 10:00 8
11/24/13 10:01 6
11/24/13 10:02 4
etc

View solution in original post

0 Karma

hogan24
Path Finder

I think I may have figured this one out through suggestions and trial and error...

create_dt_tm | convert timeformat="%m/%d/%y %H:%M" ctime(create_dt_tm) as Minute | stats count as "Transactions" by Minute

This gives me the following which is what I was looking for. Thanks to those who helped!
Minute Transactions
11/24/13 10:00 8
11/24/13 10:01 6
11/24/13 10:02 4
etc

0 Karma

somesoni2
Revered Legend

Try following

index=main sourcetype=yoursourcetype| eval create_dt_tm=strptime(create_dt_tm,"%Y-%m-%d %H:%M") | stats count by create_dt_tm | eval create_dt_tm=strftime(create_dt_tm,"%Y-%m-%d %H:%M")
0 Karma

rechteklebe
Path Finder

You could extract the values until the minutes in create_dt_tm field by using Rex Command.
With the New field you can simply make a timechart span=1m count by "newfield".

0 Karma
Get Updates on the Splunk Community!

Cloud Platform & Enterprise: Classic Dashboard Export Feature Deprecation

As of Splunk Cloud Platform 9.3.2408 and Splunk Enterprise 9.4, classic dashboard export features are now ...

Explore the Latest Educational Offerings from Splunk (November Releases)

At Splunk Education, we are committed to providing a robust learning experience for all users, regardless of ...

New This Month in Splunk Observability Cloud - Metrics Usage Analytics, Enhanced K8s ...

The latest enhancements across the Splunk Observability portfolio deliver greater flexibility, better data and ...