Splunk Search

How do I group and identify a set of events based on a time range?

hans
Splunk Employee
Splunk Employee

Let say I have events coming in everyday and I want to group the events as Monday's events, Tuesday's events, and so on. How do I do that?

1 Solution

gkanapathy
Splunk Employee
Splunk Employee

If the incoming events have time stamps already on them, or the time stamp is in the file name, you can configure Splunk to parse the time stamp and apply it to the events. Many time formats will be automatically recognized, or you can specify one explicity with settings available in props.conf.

When you view them, you can ask for any time range of events, or use reporting commands to group them by any span of time, e.g. sourcetype=mydate earliest=-60d latest=-1d | timechart span=1d count

If the events are not stamped with a time, and you want to indicate their time using the current time, you can configure Splunk to stamp them the current time by using

DATETIME_CONFIG = CURRENT

for the incoming data's sourcetype (or source or host) in props.conf

View solution in original post

hulahoop
Splunk Employee
Splunk Employee

Also, Splunk provides default datetime fields to aid in time-based grouping/searching. These fields are available on any event:

  • date_second
  • date_minute
  • date_hour
  • date_mday (the day of the month)
  • date_wday (the day of the week)
  • date_month
  • date_year

To group events by day of the week, let's say for Monday, use date_wday=monday. If grouping by day of the week in a chart try:

... | timechart span=1d count by date_wday

More details and examples are available here: http://docs.splunk.com/Documentation/Splunk/5.0/Knowledge/Usedefaultfields#Default_datetime_fields

Happy dating! 😉

gkanapathy
Splunk Employee
Splunk Employee

If the incoming events have time stamps already on them, or the time stamp is in the file name, you can configure Splunk to parse the time stamp and apply it to the events. Many time formats will be automatically recognized, or you can specify one explicity with settings available in props.conf.

When you view them, you can ask for any time range of events, or use reporting commands to group them by any span of time, e.g. sourcetype=mydate earliest=-60d latest=-1d | timechart span=1d count

If the events are not stamped with a time, and you want to indicate their time using the current time, you can configure Splunk to stamp them the current time by using

DATETIME_CONFIG = CURRENT

for the incoming data's sourcetype (or source or host) in props.conf

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...