Splunk Search

Getting the counts

xvxt006
Contributor

Hi i have this query - sourcetype=access_combined_cookie uri="xxxxx" jsession!=- | bucket _time span=5m | stats count by _time,jsession, | where count > 100

i basically want to get a timechart of count of jsessions for which uri xxxx is executed more than 100 times in 5m period.

i have used timechart but did not work. can you pls help me modify this query.

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

Based on this clarification:

I need the total count for that day but I don't need to show the uri count, I need the instances count of how many times it exceeded > 100 (within 5 minutes).

This should work when run for at least 1 full day (or more):

 sourcetype=access_combined_cookie uri="xxxxx" jsession!=- | bucket _time span=5m | stats count BY _time jsession | timechart span=1d count(eval(count>100)) AS count BY jsession

View solution in original post

woodcock
Esteemed Legend

Based on this clarification:

I need the total count for that day but I don't need to show the uri count, I need the instances count of how many times it exceeded > 100 (within 5 minutes).

This should work when run for at least 1 full day (or more):

 sourcetype=access_combined_cookie uri="xxxxx" jsession!=- | bucket _time span=5m | stats count BY _time jsession | timechart span=1d count(eval(count>100)) AS count BY jsession

xvxt006
Contributor

Thank you. this is close. But when i just execute - sourcetype=access_combined_cookie uri="xxxxx" jsession!=- | bucket _time span=5m | stats count BY _time jsession | where count > 100

i am getting 27 results but when i use your latest query i see 16 results. trying to find why is the difference

0 Karma

xvxt006
Contributor

Thank you

0 Karma

xvxt006
Contributor

Awesome. Actually this is correct.

0 Karma

woodcock
Esteemed Legend

You are probably doing "last 24 hours" instead of "yesterday"; the former splits across 2 days so will show differently between the 2 searches. Run both searches for "yesterday" or "today" and the values will be the same. The former evaluates every 5m interval for the entire timepicker range (regardless of days), the latter breaks out by days.

0 Karma

woodcock
Esteemed Legend

If I understand you correctly, this should do it (you were almost there):

sourcetype=access_combined_cookie uri="xxxxx" jsession!=- | bucket _time span=5m | stats count BY _time jsession | where count > 100 | timechart span=5m first(count) AS count BY jsession

Or

sourcetype=access_combined_cookie uri="xxxxx" jsession!=- | timechart span=5m count BY jsession | where count>100
0 Karma

xvxt006
Contributor

Hi,
i have tried the timechart one previously but that is not giving me any results. Going back to the first query, after i took out _time, i am getting i think may be the first one for that day. But i need the total count for that day. Also i don't need to show the uri count, but i need the instances count of how many times it exceeded > 100.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...