Splunk Search

Help me with search query for my usecase

sravankaripe
Communicator

i want to list out the success count by time
Example:

index="ABC" sourcetype="XYZ" responsecode="200"|

Time count

last 1hour(1:00am) 20
other 1hour(2:00am) 10

please help me with sample query

0 Karma
1 Solution

kiran331
Builder

index="ABC" sourcetype="XYZ" responsecode="200"|timechart span=1h count

refer this one
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/timechart

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi sravankaripe,
you can use timechart command to count the number of events in every hour:

index="ABC" sourcetype="XYZ" responsecode="200"
| timechart count span=1h

In addition, you can also compare count of each hour with the corresponding hour of e.g. last week using timewrap command (see http://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Timewrap):

index="ABC" sourcetype="XYZ" responsecode="200"
| timechart count span=1h
| timewrap 1week

Bye.
Giuseppe

0 Karma

woodcock
Esteemed Legend

Like this:

index="ABC" sourcetype="XYZ" | bin _time span=1h | stats count(eval(responsecode="200")) AS success count BY _time
0 Karma

kiran331
Builder

index="ABC" sourcetype="XYZ" responsecode="200"|timechart span=1h count

refer this one
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/timechart

0 Karma

3no
Communicator

Hi

index="ABC" sourcetype="XYZ" responsecode="200"| timechart span=1h count

3no.

0 Karma

adonio
Ultra Champion

is that what you are looking for?
.... | timechart span=1h count

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...