Splunk Search

How do you divide a count of events in timechart?

mark_groenveld
Path Finder

We would like to count the number of error events in 15 minute intervals and show that number as the number of errors per minute for the previous 15 minutes. How would I do that using the timechart command?

Sample search: index=main loglevel=error earliest=-15m | timechart span=15m

What would the rest be?

0 Karma

sundareshr
Legend

See if this gives you what you're looking for

index=_internal error  | timechart span=15m count | eval min=count/15 

OR

 index=_internal error  earliest=-15m@m | timechart span=1m count 
0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...