Help group by second level using _time function

[dhavamanis]

We have the logs with milliseconds, but when use _time function and its not giving the second level grouped results, Can you please help us to group the results upto seconds.

Query :

index="idxweblog" source="/var/log/idx/api.log" "/member/login"  | stats count as individual_event by _time

Output :

2014-10-31 16:38:55     1
2014-10-31 16:39:23     1
2014-10-31 17:02:21     1
2014-10-31 17:02:21     1
2014-10-31 17:02:21     1
2014-10-31 17:02:21     1
2014-10-31 17:02:21     1
2014-10-31 17:02:21     1
2014-10-31 17:02:21    1

[dhavamanis · Accepted solution]

After adding time format and we got the required output.

index="idxweblog" source="/var/log/idx/api.log" "/member/login" "API_KEY=c6e823fff8b14405a04408162bbe6e11" | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(_time) AS c_time | stats count as individual_event by c_time | stats sum(individual_event) as total_sec by c_time

[martin_mueller]

_time is not a function, it's a field. It contains the unix epoch timestamp for that particular event.

timechart is a search command, and most likely what you want. http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/timechart

[martin_mueller]

By default the _time column doesn't render milliseconds. You can see that by appending this:

... | eval mytime = strftime(_time, "%F %T.%3N")

Go with timechart though.

[dhavamanis]

seems the below one working fine,

index="idxweblog" source="/var/log/idx/api.log" "/member/login" "API_KEY=c6e823fff8b14405a04408162bbe6e11" | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(_time) AS c_time | stats count as individual_event by c_time | stats sum(individual_event) as total_sec by c_time

expected Output :

2014-10-31 16:38:55 1
2014-10-31 16:39:23 1
2014-10-31 17:02:21 7

but we would like to know the difference between _time and timechart. seems timechart also using the _time function at back end. when we do " timechart span=1s count" not giving the correct results.

[somesoni2]

What is the expected output?

try this as well

index="idxweblog" source="/var/log/idx/api.log" "/member/login"  | timechart span=1s count as individual_event