Splunk Search

Display count for multiple time increments

cejohnson
Explorer

I have log data that tracks the completion of jobs. I'd like to be able to track the completed jobs, but for 4 different increments: the last 5 minutes, last 30 minutes, last hour, and last 24 hours, and I'd like it to be displayed in a table, something like this.

JobType | 5mins  | 30mins | 60mins | 24hrs  
AA          2        30      100       150
BB          0        10       20        30

And the data resembles something like this:

<timestamp> JobType=AA status=Finished
<timestamp> JobType=BB status=Finished

I can do a count on status=Finished and dump that to a simpleResultsTable by JobType for the entire log file or for a single start/end period. But how would I send that to a simpleResultsTable for multiple increments?

1 Solution

David
Splunk Employee
Splunk Employee

You should be able to use eval and relative_time to sort this one out:

status=Finished 
      | stats sum(eval(if(_time > relative_time(now(), "-5m"),1,0))) as 5mins,  
              sum(eval(if(_time > relative_time(now(), "-30m"),1,0))) as 30mins,  
              sum(eval(if(_time > relative_time(now(), "-60m"),1,0))) as 60mins,  
              sum(eval(if(_time > relative_time(now(), "-24h"),1,0))) as 24hrs by JobType

Let me know if that works.

View solution in original post

David
Splunk Employee
Splunk Employee

You should be able to use eval and relative_time to sort this one out:

status=Finished 
      | stats sum(eval(if(_time > relative_time(now(), "-5m"),1,0))) as 5mins,  
              sum(eval(if(_time > relative_time(now(), "-30m"),1,0))) as 30mins,  
              sum(eval(if(_time > relative_time(now(), "-60m"),1,0))) as 60mins,  
              sum(eval(if(_time > relative_time(now(), "-24h"),1,0))) as 24hrs by JobType

Let me know if that works.

David
Splunk Employee
Splunk Employee

Excellent! I'm glad to hear that.

0 Karma

cejohnson
Explorer

Yes that works. Thanks!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...