Splunk Search

Get 10 minutes before 1 minute

mkoh
New Member

If I search, I can see the count value of each field for one minute, and also want to know the sum count value 10 minutes before that.

For example
At FFM_count 2 on 20170101 00:15:00
Please see the FFM_count sum from 201701 00:04 to 201701 00:14.

Is it possible for a splunk to express this way?
If possible, I'd like to know how.alt textalt text

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

YOUR SEARCH HERE
| streamstats current=f window=10 sum(*count) AS sum_last_10_*count

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

YOUR SEARCH HERE
| streamstats current=f window=10 sum(*count) AS sum_last_10_*count
0 Karma

woodcock
Esteemed Legend

Actually, I think that you need a | reverse in there above the | streamstats or you will be getting the 10 after, not before.

0 Karma

Shan
Builder

host=* source=* earliest=-10m latest=now (Try this in your query and let me know whether it helps) . For more reference . Go through the below link.

https://docs.splunk.com/Documentation/Splunk/7.0.3/SearchReference/SearchTimeModifiers

0 Karma

Shan
Builder

@mkoh - Do the above command helps you ..

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...