Splunk Search

How to control time span in tstats search?

koshyk
Super Champion

hi,
I was looking to find more time precise dataset in the last 1 hour

|tstats summariesonly=true count from datamodel=Authentication where earliest=-60m latest=-1m  by _time,Authentication.tag,Authentication.user

This works perfectly, but the _time is automatically bucketed as per the earliest/latest settings. So if I use -60m and -1m, the precision drops to 30secs. If I change it to 24hrs, the precision drops to 30minutes or so. In normal search (like timechart i could use span), but how can we do similar span command in a tstats search?

I could find a question in similar lines, but the answer is not working on the base search which is incorrect.

0 Karma
1 Solution

harshpatel
Contributor

Have you tried?

|tstats summariesonly=true count from datamodel=Authentication by _time,Authentication.tag,Authentication.user span=60m

View solution in original post

harshpatel
Contributor

Have you tried?

|tstats summariesonly=true count from datamodel=Authentication by _time,Authentication.tag,Authentication.user span=60m

koshyk
Super Champion

Thanks for that. I've put span almost at every word except at the end 🙂
This solved the problem. Cheers

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...