Splunk Search

Determine frequency over time

chrisj
Engager

I am attempting to work out the frequency of events over the selected timespan in weeks.  Basically: count of events in current timespan divided by weeks in timespan.

I can get a count of events for the selected timespan using:

 

index=mydata
| stats count(eval(ishotfix= "false")) as hfx
| fields hfx

 

I can get the timepicker span weeks using (im sure this is terrible):

 

| makeresults
| addinfo
| eval timepickerSpanWeeks=round(((info_max_time - info_min_time)/60/60/24/7),0)
| fields timepickerSpanWeeks

 

and if I combine I am getting no results

 

| makeresults
| addinfo
| eval timepickerSpanWeeks=round(((info_max_time - info_min_time)/60/60/24/7),0)
| map search="search index=mydata"
| stats count(eval(ishotfix= "false")) as hfx
| eval rate=round((hfx/timepickerSpanWeeks), 2)
| fields rate

 

thanks in advance!

Labels (1)
0 Karma
1 Solution

chrisj
Engager
index=mydata
| addinfo | eval timepickerSpanWeeks=round(((info_max_time - info_min_time)/60/60/24/7),0)
| where ishotfix= "false"
| eventstats count(timepickerSpanWeeks) as counter
| eval rate = round(counter / timepickerSpanWeeks,2)
| top rate
| fields rate

This is what got me the result, it seems like a poor way of getting it but the number of results isn't large.  Happy for someone to revise! :slightly_smiling_face:  Thanks for your help @ITWhisperer 

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try this

index=mydata
| addinfo
| eval timepickerSpanWeeks=round(((info_max_time - info_min_time)/60/60/24/7),0)
| stats count(eval(ishotfix= "false")) as hfx
| eval rate=round((hfx/timepickerSpanWeeks), 2)

chrisj
Engager
index=mydata
| addinfo | eval timepickerSpanWeeks=round(((info_max_time - info_min_time)/60/60/24/7),0)
| where ishotfix= "false"
| eventstats count(timepickerSpanWeeks) as counter
| eval rate = round(counter / timepickerSpanWeeks,2)
| top rate
| fields rate

This is what got me the result, it seems like a poor way of getting it but the number of results isn't large.  Happy for someone to revise! :slightly_smiling_face:  Thanks for your help @ITWhisperer 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...