Splunk Search

Display day wise results for a stats count

maria2691
Path Finder

Hello

I have a below query.
sourcetype=ProcessStart OR sourcetype=ProcessEnd | transaction RunID | table RunID, Robot, host, duration

I need to count the sum(duration) by host and I want the result to be displayed day wise.

The result should be something like, Day1, host1, duration
Day1, host2, duration
Day2, host1, duration
Day2, host2, duration

How can I do that? Timechard sum(duration) span=1d works, but I need the duration to be calculated according to the host. How do I do that?

Thanks
Maria Arokiaraj

0 Karma
1 Solution

mayurr98
Super Champion

hey try this

sourcetype=ProcessStart OR sourcetype=ProcessEnd | transaction RunID | table _time RunID, Robot, host, duration | bin _time span=1d  | stats sum(duration) by _time host | sort- _time

let me know if this helps!

View solution in original post

mayurr98
Super Champion

hey try this

sourcetype=ProcessStart OR sourcetype=ProcessEnd | transaction RunID | table _time RunID, Robot, host, duration | bin _time span=1d  | stats sum(duration) by _time host | sort- _time

let me know if this helps!

maria2691
Path Finder

Hello @mayurr98

I tried this one already with bucket command and now with bin also as you have suggested.
For some reason, I am not getting any results out of these queries 😞

0 Karma

mayurr98
Super Champion

hey can you try this as | table _time RunID, Robot, host, duration seems irrelavent. Also try below query for last 7 days or more. I tried in a test environment the query is working as long as you have enough data.Specify your_index at start of the search

 index=your_index  sourcetype=ProcessStart OR sourcetype=ProcessEnd | transaction RunID | bin _time span=1d  | stats sum(duration) by _time host | sort- _time

If above query does not work then try sourcetype=ProcessStart OR sourcetype=ProcessEnd | transaction RunID and see if you get any output. If you are getting output then the above query must work.

0 Karma

maria2691
Path Finder

Thanks @mayurr98

It worked. Understood that the Table command in between caused the issue 🙂

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...