Splunk Search

How can I set bin _time value based on different fields?

whitefang1726
Path Finder

I want to run a search query but the _bin span value will change based on the field values.
Example:

Instead of using this, 

index=main sourcetype=test (host=hostnameA OR hostnameB OR hostnameC) 
| bin _time span=1h
| stats count by _time, host

for hostnameA -> I want the span value to be every 10m
for hostnameB -> every 30m
for hostnameC -> every 1h

Thanks!

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

All bin is doing is rounding down _time to the nearest span. You can do this yourself with a simple bit of maths. Here is a run-anywhere example, using gentimes to create some event, and random to assign hosts to the events, then calculating the interval between the start and each event time, rounding this down to the nearest span (dependent on the host), and adding that back to the start time. This aligns to the bins to the start time. You could do something similar if you want to align to the end time, or if you wanted even the middle time.

| gentimes start=-1 increment=10s 
| rename starttime as _time 
| fields _time
| eval host=mvindex(split("ABC",""),random() %3)


| eval span=case(host="A",10*60,host="B",30*60,host="C",60*60)
| eventstats min(_time) as start
| eval bucket=floor((_time-start)/span)*span
| eval _time=start+bucket
| stats count by _time host
0 Karma

whitefang1726
Path Finder

Nice, that works, I usually used append to add fields , never thought it would work on events as a rows. Thanks, big help @manjunathmeti !

0 Karma

manjunathmeti
Champion

You're welcome! Please upvote and accept the answer.

0 Karma

manjunathmeti
Champion

hi @whitefang1726,

You can count events for each host separately and use append to combine them.

index=main sourcetype=test host=hostnameA 
| bin _time span=10m
| stats count by _time, host
| append 
    [ search index=main sourcetype=test host=hostnameB
    | bin _time span=30m 
    | stats count by _time, host] 
| append 
    [ search index=main sourcetype=test host=hostnameC 
    | bin _time span=1h 
    | stats count by _time, host]

 

If this reply helps you, a like would be appreciated.

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...