Splunk Search
Highlighted

Help group by second level using _time function

Builder

We have the logs with milliseconds, but when use _time function and its not giving the second level grouped results, Can you please help us to group the results upto seconds.

Query :

index="idxweblog" source="/var/log/idx/api.log" "/member/login"  | stats count as individual_event by _time

Output :

2014-10-31 16:38:55     1
2014-10-31 16:39:23     1
2014-10-31 17:02:21     1
2014-10-31 17:02:21     1
2014-10-31 17:02:21     1
2014-10-31 17:02:21     1
2014-10-31 17:02:21     1
2014-10-31 17:02:21     1
2014-10-31 17:02:21    1
0 Karma
Highlighted

Re: Help group by second level using _time function

SplunkTrust
SplunkTrust

What is the expected output?

try this as well

index="idxweblog" source="/var/log/idx/api.log" "/member/login"  | timechart span=1s count as individual_event
0 Karma
Highlighted

Re: Help group by second level using _time function

SplunkTrust
SplunkTrust

By default the _time column doesn't render milliseconds. You can see that by appending this:

... | eval mytime = strftime(_time, "%F %T.%3N")

Go with timechart though.

0 Karma
Highlighted

Re: Help group by second level using _time function

Builder

seems the below one working fine,

index="idxweblog" source="/var/log/idx/api.log" "/member/login" "APIKEY=c6e823fff8b14405a04408162bbe6e11" | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(time) AS ctime | stats count as individualevent by ctime | stats sum(individualevent) as totalsec by ctime

expected Output :

2014-10-31 16:38:55 1
2014-10-31 16:39:23 1
2014-10-31 17:02:21 7

but we would like to know the difference between _time and timechart. seems timechart also using the _time function at back end. when we do " timechart span=1s count" not giving the correct results.

0 Karma
Highlighted

Re: Help group by second level using _time function

SplunkTrust
SplunkTrust

_time is not a function, it's a field. It contains the unix epoch timestamp for that particular event.

timechart is a search command, and most likely what you want. http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/timechart

0 Karma
Highlighted

Re: Help group by second level using _time function

Builder

After adding time format and we got the required output.

index="idxweblog" source="/var/log/idx/api.log" "/member/login" "APIKEY=c6e823fff8b14405a04408162bbe6e11" | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(time) AS ctime | stats count as individualevent by ctime | stats sum(individualevent) as totalsec by ctime

View solution in original post

0 Karma