Splunk Search

Frequency of events - how often an event was logged

Derek
Path Finder

Does anyone have a good way (or am I missing the something obvious?) of calculating for a defined time range the average frequency of the events logged?

Such as eventtype A appeared every X minutes.

Thanks!

Tags (1)
0 Karma
1 Solution

Simeon
Splunk Employee
Splunk Employee

I would use eval in combination with stats. For example:

sourcetype=apache_error earliest=-60m | stats count as total | eval errors_per_min=(total/60) | fields error_per_min

This would take the total # of events over the past 60 minutes, then divide by 60 to get you a count per minute. Or from the advanced charting view:

sourcetype=apache_error earliest=-60m | timechart span=1m count as error_per_min 

View solution in original post

Simeon
Splunk Employee
Splunk Employee

I would use eval in combination with stats. For example:

sourcetype=apache_error earliest=-60m | stats count as total | eval errors_per_min=(total/60) | fields error_per_min

This would take the total # of events over the past 60 minutes, then divide by 60 to get you a count per minute. Or from the advanced charting view:

sourcetype=apache_error earliest=-60m | timechart span=1m count as error_per_min 

View solution in original post

Derek
Path Finder

I knew I missing something obvious 🙂

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.