Splunk Search
Highlighted

How do I sum by strftime day?

New Member

Hello,

A simple questions I think.......

I'm moving my _time by 6 hours and creating newTime then using strftime to look at the results.

I then want to sum GJ by day of the newTime/strftime and then find the max of this?

This is the part of the search that isn't working

eval newTime = relativetime(time, "-6h")

| eval n=strftime(newTime , "%Y/%m/%d-%T")
| stats sum(GJ) as MaxDay BY n_day

Any help is appreciated

Tags (1)
0 Karma
Highlighted

Re: How do I sum by strftime day?

Legend

Try this - just use n instead of n_day

eval newTime = relative_time(_time, "-6h")
...
| eval n=strftime(newTime , "%Y/%m/%d-%T") 
| stats sum(GJ) as MaxDay BY n
Highlighted

Re: How do I sum by strftime day?

New Member

Thanks for response however this doesn't seem to work.

The bit I'm struggling with is summing by day in the adjusted strftime.

i.e. I want to sum the GJ by day (in STRFtime) and then get the max of this

0 Karma