Splunk Search

How to control time span in tstats search?

koshyk
Super Champion

hi,
I was looking to find more time precise dataset in the last 1 hour

|tstats summariesonly=true count from datamodel=Authentication where earliest=-60m latest=-1m  by _time,Authentication.tag,Authentication.user

This works perfectly, but the _time is automatically bucketed as per the earliest/latest settings. So if I use -60m and -1m, the precision drops to 30secs. If I change it to 24hrs, the precision drops to 30minutes or so. In normal search (like timechart i could use span), but how can we do similar span command in a tstats search?

I could find a question in similar lines, but the answer is not working on the base search which is incorrect.

0 Karma
1 Solution

harshpatel
Contributor

Have you tried?

|tstats summariesonly=true count from datamodel=Authentication by _time,Authentication.tag,Authentication.user span=60m

View solution in original post

harshpatel
Contributor

Have you tried?

|tstats summariesonly=true count from datamodel=Authentication by _time,Authentication.tag,Authentication.user span=60m

View solution in original post

koshyk
Super Champion

Thanks for that. I've put span almost at every word except at the end 🙂
This solved the problem. Cheers

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.