Splunk Search

How do you divide a count of events in timechart?


We would like to count the number of error events in 15 minute intervals and show that number as the number of errors per minute for the previous 15 minutes. How would I do that using the timechart command?

Sample search: index=main loglevel=error earliest=-15m | timechart span=15m

What would the rest be?

0 Karma


See if this gives you what you're looking for

index=_internal error  | timechart span=15m count | eval min=count/15 


 index=_internal error  earliest=-15m@m | timechart span=1m count 
0 Karma
Get Updates on the Splunk Community!

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through: An introduction to the Splunk Threat ...