Splunk Search

How do you divide a count of events in timechart?

mark_groenveld
Path Finder

We would like to count the number of error events in 15 minute intervals and show that number as the number of errors per minute for the previous 15 minutes. How would I do that using the timechart command?

Sample search: index=main loglevel=error earliest=-15m | timechart span=15m

What would the rest be?

0 Karma

sundareshr
Legend

See if this gives you what you're looking for

index=_internal error  | timechart span=15m count | eval min=count/15 

OR

 index=_internal error  earliest=-15m@m | timechart span=1m count 
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...