Splunk Search

Display count for multiple time increments

cejohnson
Explorer

I have log data that tracks the completion of jobs. I'd like to be able to track the completed jobs, but for 4 different increments: the last 5 minutes, last 30 minutes, last hour, and last 24 hours, and I'd like it to be displayed in a table, something like this.

JobType | 5mins  | 30mins | 60mins | 24hrs  
AA          2        30      100       150
BB          0        10       20        30

And the data resembles something like this:

<timestamp> JobType=AA status=Finished
<timestamp> JobType=BB status=Finished

I can do a count on status=Finished and dump that to a simpleResultsTable by JobType for the entire log file or for a single start/end period. But how would I send that to a simpleResultsTable for multiple increments?

1 Solution

David
Splunk Employee
Splunk Employee

You should be able to use eval and relative_time to sort this one out:

status=Finished 
      | stats sum(eval(if(_time > relative_time(now(), "-5m"),1,0))) as 5mins,  
              sum(eval(if(_time > relative_time(now(), "-30m"),1,0))) as 30mins,  
              sum(eval(if(_time > relative_time(now(), "-60m"),1,0))) as 60mins,  
              sum(eval(if(_time > relative_time(now(), "-24h"),1,0))) as 24hrs by JobType

Let me know if that works.

View solution in original post

David
Splunk Employee
Splunk Employee

You should be able to use eval and relative_time to sort this one out:

status=Finished 
      | stats sum(eval(if(_time > relative_time(now(), "-5m"),1,0))) as 5mins,  
              sum(eval(if(_time > relative_time(now(), "-30m"),1,0))) as 30mins,  
              sum(eval(if(_time > relative_time(now(), "-60m"),1,0))) as 60mins,  
              sum(eval(if(_time > relative_time(now(), "-24h"),1,0))) as 24hrs by JobType

Let me know if that works.

David
Splunk Employee
Splunk Employee

Excellent! I'm glad to hear that.

0 Karma

cejohnson
Explorer

Yes that works. Thanks!

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...