Splunk Search

Get daily event count with reference to a field called "TIME_CREATED" rather than using index time

anz999
Loves-to-Learn Lots

Tried to use the below query but unfortunately events are grouped with reference to _time

index=omi_UAT host=* sourcetype=all_events_custom_attributes SEVERITY IN (CRITICAL,MAJOR,MINOR) OR (SEVERITY=WARNING AND APPLICATION=NNMi) 
| dedup ID
| timechart count(ID) BY SEVERITY
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try this. It assumes TIME_CREATED is in epoch form.

index=omi_UAT host=* sourcetype=all_events_custom_attributes SEVERITY IN (CRITICAL,MAJOR,MINOR) OR (SEVERITY=WARNING AND APPLICATION=NNMi) 
| dedup ID
| eval _time = TIME_CREATED
| timechart count(ID) BY SEVERITY
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this. It assumes TIME_CREATED is in epoch form.

index=omi_UAT host=* sourcetype=all_events_custom_attributes SEVERITY IN (CRITICAL,MAJOR,MINOR) OR (SEVERITY=WARNING AND APPLICATION=NNMi) 
| dedup ID
| eval _time = TIME_CREATED
| timechart count(ID) BY SEVERITY
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

anz999
Loves-to-Learn Lots

Sorry it didn't worked, TIME_CREATED is in the format "2019-12-13 13:32:25.0"

0 Karma

richgalloway
SplunkTrust
SplunkTrust

So convert it.

index=omi_UAT host=* sourcetype=all_events_custom_attributes SEVERITY IN (CRITICAL,MAJOR,MINOR) OR (SEVERITY=WARNING AND APPLICATION=NNMi) 
| dedup ID
| eval _time = strptime(TIME_CREATED, "%Y-%m-%d %H:%M:%S.%N")
| timechart count(ID) BY SEVERITY
---
If this reply helps you, an upvote would be appreciated.
0 Karma