Splunk Search

Count the number of api occurrence in 10 second

Path Finder

I have the following API's, for which I need to count the occurrence of each in every 10 seconds for 1 hour time interval.


I tried with

host=*localhost* Path=*** sourcetype=nginx 
| where Path in ("/api/platform/v1/session" OR "/api/coredata/v1/graphql" OR "/api/trading/v1/orders")
| table Path

But getting Error in 'where' command: Typechecking failed. 'OR' only takes boolean arguments

Basically I want the count of all the listed api in every 10 seconds for 1-hour interval.

Tags (2)
0 Karma

Splunk Employee
Splunk Employee

Here is an example from some different data:

sourcetype=access_combined earliest=-60m
| bin _time span=10s
| timechart count by action

You might consider using Trellis visualization as well, which automatically creates a different line graph for each.
alt text

0 Karma


It should be smething like below,

host=*localhost* Path=*** sourcetype=nginx 
 | search Path IN  ("/api/platform/v1/session" ,"/api/coredata/v1/graphql" , "/api/trading/v1/orders")
 | table Path
| timechart count span=10s


Path Finder

@techiesid this work fine without timechart count span=10s, when I use this no result is coming

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!