Splunk Search

Display day wise results for a stats count

maria2691
Path Finder

Hello

I have a below query.
sourcetype=ProcessStart OR sourcetype=ProcessEnd | transaction RunID | table RunID, Robot, host, duration

I need to count the sum(duration) by host and I want the result to be displayed day wise.

The result should be something like, Day1, host1, duration
Day1, host2, duration
Day2, host1, duration
Day2, host2, duration

How can I do that? Timechard sum(duration) span=1d works, but I need the duration to be calculated according to the host. How do I do that?

Thanks
Maria Arokiaraj

0 Karma
1 Solution

mayurr98
Super Champion

hey try this

sourcetype=ProcessStart OR sourcetype=ProcessEnd | transaction RunID | table _time RunID, Robot, host, duration | bin _time span=1d  | stats sum(duration) by _time host | sort- _time

let me know if this helps!

View solution in original post

mayurr98
Super Champion

hey try this

sourcetype=ProcessStart OR sourcetype=ProcessEnd | transaction RunID | table _time RunID, Robot, host, duration | bin _time span=1d  | stats sum(duration) by _time host | sort- _time

let me know if this helps!

maria2691
Path Finder

Hello @mayurr98

I tried this one already with bucket command and now with bin also as you have suggested.
For some reason, I am not getting any results out of these queries 😞

0 Karma

mayurr98
Super Champion

hey can you try this as | table _time RunID, Robot, host, duration seems irrelavent. Also try below query for last 7 days or more. I tried in a test environment the query is working as long as you have enough data.Specify your_index at start of the search

 index=your_index  sourcetype=ProcessStart OR sourcetype=ProcessEnd | transaction RunID | bin _time span=1d  | stats sum(duration) by _time host | sort- _time

If above query does not work then try sourcetype=ProcessStart OR sourcetype=ProcessEnd | transaction RunID and see if you get any output. If you are getting output then the above query must work.

0 Karma

maria2691
Path Finder

Thanks @mayurr98

It worked. Understood that the Table command in between caused the issue 🙂

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...