Splunk Search

Get 10 minutes before 1 minute

mkoh
New Member

If I search, I can see the count value of each field for one minute, and also want to know the sum count value 10 minutes before that.

For example
At FFM_count 2 on 20170101 00:15:00
Please see the FFM_count sum from 201701 00:04 to 201701 00:14.

Is it possible for a splunk to express this way?
If possible, I'd like to know how.alt textalt text

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

YOUR SEARCH HERE
| streamstats current=f window=10 sum(*count) AS sum_last_10_*count

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

YOUR SEARCH HERE
| streamstats current=f window=10 sum(*count) AS sum_last_10_*count

View solution in original post

0 Karma

woodcock
Esteemed Legend

Actually, I think that you need a | reverse in there above the | streamstats or you will be getting the 10 after, not before.

0 Karma

Shan
Builder

host=* source=* earliest=-10m latest=now (Try this in your query and let me know whether it helps) . For more reference . Go through the below link.

https://docs.splunk.com/Documentation/Splunk/7.0.3/SearchReference/SearchTimeModifiers

0 Karma

Shan
Builder

@mkoh - Do the above command helps you ..

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!