Getting the counts

[xvxt006]

Hi i have this query - sourcetype=access_combined_cookie uri="xxxxx" jsession!=- | bucket _time span=5m | stats count by _time,jsession, | where count > 100

i basically want to get a timechart of count of jsessions for which uri xxxx is executed more than 100 times in 5m period.

i have used timechart but did not work. can you pls help me modify this query.

[woodcock · Accepted solution]

Based on this clarification:

I need the total count for that day but I don't need to show the uri count, I need the instances count of how many times it exceeded > 100 (within 5 minutes).

This should work when run for at least 1 full day (or more):

 sourcetype=access_combined_cookie uri="xxxxx" jsession!=- | bucket _time span=5m | stats count BY _time jsession | timechart span=1d count(eval(count>100)) AS count BY jsession

[xvxt006]

Thank you. this is close. But when i just execute - sourcetype=access_combined_cookie uri="xxxxx" jsession!=- | bucket _time span=5m | stats count BY _time jsession | where count > 100

i am getting 27 results but when i use your latest query i see 16 results. trying to find why is the difference

[xvxt006]

Thank you

[xvxt006]

Awesome. Actually this is correct.

[woodcock]

You are probably doing "last 24 hours" instead of "yesterday"; the former splits across 2 days so will show differently between the 2 searches. Run both searches for "yesterday" or "today" and the values will be the same. The former evaluates every 5m interval for the entire timepicker range (regardless of days), the latter breaks out by days.

[woodcock]

If I understand you correctly, this should do it (you were almost there):

sourcetype=access_combined_cookie uri="xxxxx" jsession!=- | bucket _time span=5m | stats count BY _time jsession | where count > 100 | timechart span=5m first(count) AS count BY jsession

Or

sourcetype=access_combined_cookie uri="xxxxx" jsession!=- | timechart span=5m count BY jsession | where count>100

[xvxt006]

Hi,
i have tried the timechart one previously but that is not giving me any results. Going back to the first query, after i took out _time, i am getting i think may be the first one for that day. But i need the total count for that day. Also i don't need to show the uri count, but i need the instances count of how many times it exceeded > 100.