Splunk Search

Display day wise results for a stats count

maria2691
Path Finder

Hello

I have a below query.
sourcetype=ProcessStart OR sourcetype=ProcessEnd | transaction RunID | table RunID, Robot, host, duration

I need to count the sum(duration) by host and I want the result to be displayed day wise.

The result should be something like, Day1, host1, duration
Day1, host2, duration
Day2, host1, duration
Day2, host2, duration

How can I do that? Timechard sum(duration) span=1d works, but I need the duration to be calculated according to the host. How do I do that?

Thanks
Maria Arokiaraj

0 Karma
1 Solution

mayurr98
Super Champion

hey try this

sourcetype=ProcessStart OR sourcetype=ProcessEnd | transaction RunID | table _time RunID, Robot, host, duration | bin _time span=1d  | stats sum(duration) by _time host | sort- _time

let me know if this helps!

View solution in original post

mayurr98
Super Champion

hey try this

sourcetype=ProcessStart OR sourcetype=ProcessEnd | transaction RunID | table _time RunID, Robot, host, duration | bin _time span=1d  | stats sum(duration) by _time host | sort- _time

let me know if this helps!

maria2691
Path Finder

Hello @mayurr98

I tried this one already with bucket command and now with bin also as you have suggested.
For some reason, I am not getting any results out of these queries 😞

0 Karma

mayurr98
Super Champion

hey can you try this as | table _time RunID, Robot, host, duration seems irrelavent. Also try below query for last 7 days or more. I tried in a test environment the query is working as long as you have enough data.Specify your_index at start of the search

 index=your_index  sourcetype=ProcessStart OR sourcetype=ProcessEnd | transaction RunID | bin _time span=1d  | stats sum(duration) by _time host | sort- _time

If above query does not work then try sourcetype=ProcessStart OR sourcetype=ProcessEnd | transaction RunID and see if you get any output. If you are getting output then the above query must work.

0 Karma

maria2691
Path Finder

Thanks @mayurr98

It worked. Understood that the Table command in between caused the issue 🙂

0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Community Content Calendar, October Edition

Welcome to the October edition of our Community Spotlight! The Splunk Community is a treasure trove of ...

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...