Splunk Search

How do you divide a count of events in timechart?

mark_groenveld
Path Finder

We would like to count the number of error events in 15 minute intervals and show that number as the number of errors per minute for the previous 15 minutes. How would I do that using the timechart command?

Sample search: index=main loglevel=error earliest=-15m | timechart span=15m

What would the rest be?

0 Karma

sundareshr
Legend

See if this gives you what you're looking for

index=_internal error  | timechart span=15m count | eval min=count/15 

OR

 index=_internal error  earliest=-15m@m | timechart span=1m count 
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...