Splunk Search

Hourly breakdown of data with math operation

chablist
New Member

I have a log file that always has the same structure of:
time1,time2,groupNumber

eg:
355350224,338837556,2
1355350228,338837557,2
1355312572,338828143,2
1355350212,338837553,2
1355350216,338837554,2
1355350220,338837555,2
1355350224,338837556,2
1355310304,338827576,2

I want to group the times into buckets of a 1 hour span and then take the resulting count in each of those buckets and divide them by a number lets say 60.

So assume i have 10 items during the 12am-1am window on 12/12 and 5 items during the 1am-2am window on 12/12

This will give me a resulting table looking like:

Time | FunctionEvaluation
12/12 12am | .16667
12/12 1am | .08333

I was able to get close with:
source = Data _raw=",,4" | timechart span=1h count

but i couldn't perform a math operation

and with this i wasn't able to breakdown by time:
source = Data | rex field=_raw ".,.,(?\d+)" | top 20 groupNumber | sort groupNumber | eval reliability = (1 - (count/12960))*100 | fields groupNumber, reliability

Tags (1)
0 Karma

chablist
New Member

finally figured it out:
source = Data _raw=",,4" | timechart span=1h count | eval reliability = count/60

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...