Splunk Search

How do you divide a count of events in timechart?

mark_groenveld
Path Finder

We would like to count the number of error events in 15 minute intervals and show that number as the number of errors per minute for the previous 15 minutes. How would I do that using the timechart command?

Sample search: index=main loglevel=error earliest=-15m | timechart span=15m

What would the rest be?

0 Karma

sundareshr
Legend

See if this gives you what you're looking for

index=_internal error  | timechart span=15m count | eval min=count/15 

OR

 index=_internal error  earliest=-15m@m | timechart span=1m count 
0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...