Splunk Search

Count days with events

NaorPenso
Explorer

Hi everyone,
I have looked all over for a solution but without luck, so i'm approaching you hoping to find a solution.
I would like to count the amount of days (not the amount of events) that has events based on a ctime value in the log.

Sample log:

1398963749 1398963749 1432 1404320549
0 0 10446976 15988 2 4 0
DD_Servers_2003-2008_1398963749_FULL.f
NULL NULL 0 1 0 2 1399050149 NULL 1 0 0 0 0 0 0 NULL 0 0 0 NULL 777220 1 0 1999619 0 0 NULL 3 1398963602 3 0 NULL NULL 0 1 0 0

The first field states the EPOCH time of the event start (i should mention right away that Splunk time is not relevant as it is the time of insertion to the index, not this field)
what I do is:

index="foo" | convert ctime(bar)

From here on im stuck as to how to count the amount of days with the event (i.e. 33 days with events)

Thanks in advance

Tags (3)
0 Karma
1 Solution

lguinn2
Legend

I would do it like this

index="foo"
| bucket ctime span=1d
| stats dc(ctime) as numberofuniquedays

If you want to check that this makes sense, try

index="foo"
| bucket ctime span=1d
| stats count by ctime
| fieldformat ctime=strftime(ctime,"%x %X")

BTW, you can get Splunk to use the ctime of the event - and you probably should. It will make a lot of the reports easier and more sensible. Here is how do that:

props.conf

[sourcetypeOfData]
MAX_TIMESTAMP_LOOKAHEAD = 11
TIME_FORMAT = %s

This props.conf goes on the indexer(s), or wherever the data is being parsed.

View solution in original post

0 Karma

lguinn2
Legend

I would do it like this

index="foo"
| bucket ctime span=1d
| stats dc(ctime) as numberofuniquedays

If you want to check that this makes sense, try

index="foo"
| bucket ctime span=1d
| stats count by ctime
| fieldformat ctime=strftime(ctime,"%x %X")

BTW, you can get Splunk to use the ctime of the event - and you probably should. It will make a lot of the reports easier and more sensible. Here is how do that:

props.conf

[sourcetypeOfData]
MAX_TIMESTAMP_LOOKAHEAD = 11
TIME_FORMAT = %s

This props.conf goes on the indexer(s), or wherever the data is being parsed.

0 Karma

NaorPenso
Explorer

Hi,
Thanks a lot, you steered me to the correct path.
it didn't work exactly as i wanted so what i did is:

index="foo" |
convert ctime(bar) as Time timeformat=%m/%d/%y |
bucket Time span=1d |
stats dc(Time) as numberofuniquedays

Thanks again!!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...