Splunk Search

Count events for each time value in a given interval

kiruwka
New Member

Dear Community.
Given:

  • events, each has start_time, end_time
  • Time Range: [BEGIN, END]

output the following statistic:

for each time t, in [BEGIN, END] with interval 5 Min, count how many events satisfy: start_time < t < end_time

I am looking at concurrency and timechart, but can't wrap my head around. Any help would be very appreciated!

Labels (2)
0 Karma

tscroggins
Influencer

@kiruwka 

This is a good candidate for using a custom command, but you can do this in a resource intensive way using a join and e.g. gentimes to create a list of t values:

 

| join max=0 type=outer ```generate a field of t values```
    [| gentimes start=12/27/2021 end=12/28/2021 increment=300 
    | eval t=tonumber(starttime) 
    | fields + t 
    | mvcombine t ] 
| eval start_time=strptime(start_time, "%F %T") ```convert start_time to an epoch value```
| eval end_time=strptime(end_time, "%F %T") ```convert end_time to an epoch value```
| eval t=split(t, " ") ```convert t values to a multivalued field```
| eval t=mvmap(t, t."|".if(start_time<=t AND t<end_time, 1, 0)) ```compare start_time and end_time to each t value```
| mvexpand t ```expand all t value comparisons into separate events```
| eval t=split(t, "|") ```convert t value comparions to a multivalued field```
| eval _time=mvindex(t, 0) ```set _time to the t value```
| eval count=mvindex(t, 1) ```set count to the comparison value (0 or 1)```
| stats sum(count) by _time

 

I used start_time <= t < end_time to bin values where start_time == t. You could alternatively use start_time < t <= end_time, but without one or the other, some events may not be counted.

If all transaction durations are exactly the interval time, e.g. 5 minutes, you can use timechart:

 

| eval _time=end_time ```or strptime(end_time, "%F %T") or whatever's appropriate```
| timechart span=5m count

 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...