Splunk Search

How do I group and identify a set of events based on a time range?

hans
Splunk Employee
Splunk Employee

Let say I have events coming in everyday and I want to group the events as Monday's events, Tuesday's events, and so on. How do I do that?

1 Solution

gkanapathy
Splunk Employee
Splunk Employee

If the incoming events have time stamps already on them, or the time stamp is in the file name, you can configure Splunk to parse the time stamp and apply it to the events. Many time formats will be automatically recognized, or you can specify one explicity with settings available in props.conf.

When you view them, you can ask for any time range of events, or use reporting commands to group them by any span of time, e.g. sourcetype=mydate earliest=-60d latest=-1d | timechart span=1d count

If the events are not stamped with a time, and you want to indicate their time using the current time, you can configure Splunk to stamp them the current time by using

DATETIME_CONFIG = CURRENT

for the incoming data's sourcetype (or source or host) in props.conf

View solution in original post

hulahoop
Splunk Employee
Splunk Employee

Also, Splunk provides default datetime fields to aid in time-based grouping/searching. These fields are available on any event:

  • date_second
  • date_minute
  • date_hour
  • date_mday (the day of the month)
  • date_wday (the day of the week)
  • date_month
  • date_year

To group events by day of the week, let's say for Monday, use date_wday=monday. If grouping by day of the week in a chart try:

... | timechart span=1d count by date_wday

More details and examples are available here: http://docs.splunk.com/Documentation/Splunk/5.0/Knowledge/Usedefaultfields#Default_datetime_fields

Happy dating! 😉

gkanapathy
Splunk Employee
Splunk Employee

If the incoming events have time stamps already on them, or the time stamp is in the file name, you can configure Splunk to parse the time stamp and apply it to the events. Many time formats will be automatically recognized, or you can specify one explicity with settings available in props.conf.

When you view them, you can ask for any time range of events, or use reporting commands to group them by any span of time, e.g. sourcetype=mydate earliest=-60d latest=-1d | timechart span=1d count

If the events are not stamped with a time, and you want to indicate their time using the current time, you can configure Splunk to stamp them the current time by using

DATETIME_CONFIG = CURRENT

for the incoming data's sourcetype (or source or host) in props.conf

Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...