We have the logs with milliseconds, but when use _time function and its not giving the second level grouped results, Can you please help us to group the results upto seconds.
Query :
index="idxweblog" source="/var/log/idx/api.log" "/member/login" | stats count as individual_event by _time
Output :
2014-10-31 16:38:55 1
2014-10-31 16:39:23 1
2014-10-31 17:02:21 1
2014-10-31 17:02:21 1
2014-10-31 17:02:21 1
2014-10-31 17:02:21 1
2014-10-31 17:02:21 1
2014-10-31 17:02:21 1
2014-10-31 17:02:21 1
After adding time format and we got the required output.
index="idxweblog" source="/var/log/idx/api.log" "/member/login" "API_KEY=c6e823fff8b14405a04408162bbe6e11" | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(_time) AS c_time | stats count as individual_event by c_time | stats sum(individual_event) as total_sec by c_time
After adding time format and we got the required output.
index="idxweblog" source="/var/log/idx/api.log" "/member/login" "API_KEY=c6e823fff8b14405a04408162bbe6e11" | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(_time) AS c_time | stats count as individual_event by c_time | stats sum(individual_event) as total_sec by c_time
_time
is not a function, it's a field. It contains the unix epoch timestamp for that particular event.
timechart
is a search command, and most likely what you want. http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/timechart
By default the _time
column doesn't render milliseconds. You can see that by appending this:
... | eval mytime = strftime(_time, "%F %T.%3N")
Go with timechart
though.
seems the below one working fine,
index="idxweblog" source="/var/log/idx/api.log" "/member/login" "API_KEY=c6e823fff8b14405a04408162bbe6e11" | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(_time) AS c_time | stats count as individual_event by c_time | stats sum(individual_event) as total_sec by c_time
expected Output :
2014-10-31 16:38:55 1
2014-10-31 16:39:23 1
2014-10-31 17:02:21 7
but we would like to know the difference between _time and timechart. seems timechart also using the _time function at back end. when we do " timechart span=1s count" not giving the correct results.
What is the expected output?
try this as well
index="idxweblog" source="/var/log/idx/api.log" "/member/login" | timechart span=1s count as individual_event