Splunk Search

How do I group and identify a set of events based on a time range?

hans
Splunk Employee
Splunk Employee

Let say I have events coming in everyday and I want to group the events as Monday's events, Tuesday's events, and so on. How do I do that?

1 Solution

gkanapathy
Splunk Employee
Splunk Employee

If the incoming events have time stamps already on them, or the time stamp is in the file name, you can configure Splunk to parse the time stamp and apply it to the events. Many time formats will be automatically recognized, or you can specify one explicity with settings available in props.conf.

When you view them, you can ask for any time range of events, or use reporting commands to group them by any span of time, e.g. sourcetype=mydate earliest=-60d latest=-1d | timechart span=1d count

If the events are not stamped with a time, and you want to indicate their time using the current time, you can configure Splunk to stamp them the current time by using

DATETIME_CONFIG = CURRENT

for the incoming data's sourcetype (or source or host) in props.conf

View solution in original post

hulahoop
Splunk Employee
Splunk Employee

Also, Splunk provides default datetime fields to aid in time-based grouping/searching. These fields are available on any event:

  • date_second
  • date_minute
  • date_hour
  • date_mday (the day of the month)
  • date_wday (the day of the week)
  • date_month
  • date_year

To group events by day of the week, let's say for Monday, use date_wday=monday. If grouping by day of the week in a chart try:

... | timechart span=1d count by date_wday

More details and examples are available here: http://docs.splunk.com/Documentation/Splunk/5.0/Knowledge/Usedefaultfields#Default_datetime_fields

Happy dating! 😉

gkanapathy
Splunk Employee
Splunk Employee

If the incoming events have time stamps already on them, or the time stamp is in the file name, you can configure Splunk to parse the time stamp and apply it to the events. Many time formats will be automatically recognized, or you can specify one explicity with settings available in props.conf.

When you view them, you can ask for any time range of events, or use reporting commands to group them by any span of time, e.g. sourcetype=mydate earliest=-60d latest=-1d | timechart span=1d count

If the events are not stamped with a time, and you want to indicate their time using the current time, you can configure Splunk to stamp them the current time by using

DATETIME_CONFIG = CURRENT

for the incoming data's sourcetype (or source or host) in props.conf

Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...