Splunk Search

Getting the counts

xvxt006
Contributor

Hi i have this query - sourcetype=access_combined_cookie uri="xxxxx" jsession!=- | bucket _time span=5m | stats count by _time,jsession, | where count > 100

i basically want to get a timechart of count of jsessions for which uri xxxx is executed more than 100 times in 5m period.

i have used timechart but did not work. can you pls help me modify this query.

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

Based on this clarification:

I need the total count for that day but I don't need to show the uri count, I need the instances count of how many times it exceeded > 100 (within 5 minutes).

This should work when run for at least 1 full day (or more):

 sourcetype=access_combined_cookie uri="xxxxx" jsession!=- | bucket _time span=5m | stats count BY _time jsession | timechart span=1d count(eval(count>100)) AS count BY jsession

View solution in original post

woodcock
Esteemed Legend

Based on this clarification:

I need the total count for that day but I don't need to show the uri count, I need the instances count of how many times it exceeded > 100 (within 5 minutes).

This should work when run for at least 1 full day (or more):

 sourcetype=access_combined_cookie uri="xxxxx" jsession!=- | bucket _time span=5m | stats count BY _time jsession | timechart span=1d count(eval(count>100)) AS count BY jsession

xvxt006
Contributor

Thank you. this is close. But when i just execute - sourcetype=access_combined_cookie uri="xxxxx" jsession!=- | bucket _time span=5m | stats count BY _time jsession | where count > 100

i am getting 27 results but when i use your latest query i see 16 results. trying to find why is the difference

0 Karma

xvxt006
Contributor

Thank you

0 Karma

xvxt006
Contributor

Awesome. Actually this is correct.

0 Karma

woodcock
Esteemed Legend

You are probably doing "last 24 hours" instead of "yesterday"; the former splits across 2 days so will show differently between the 2 searches. Run both searches for "yesterday" or "today" and the values will be the same. The former evaluates every 5m interval for the entire timepicker range (regardless of days), the latter breaks out by days.

0 Karma

woodcock
Esteemed Legend

If I understand you correctly, this should do it (you were almost there):

sourcetype=access_combined_cookie uri="xxxxx" jsession!=- | bucket _time span=5m | stats count BY _time jsession | where count > 100 | timechart span=5m first(count) AS count BY jsession

Or

sourcetype=access_combined_cookie uri="xxxxx" jsession!=- | timechart span=5m count BY jsession | where count>100
0 Karma

xvxt006
Contributor

Hi,
i have tried the timechart one previously but that is not giving me any results. Going back to the first query, after i took out _time, i am getting i think may be the first one for that day. But i need the total count for that day. Also i don't need to show the uri count, but i need the instances count of how many times it exceeded > 100.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...