How to count IDs that are in the range between current_time and end_time for each second?

[diavolo]

I want to count up IDs which are in the range between current_time and end_time for each second.
For example, as for the following data source table, count 1 during 13:17:44 - 13:18:17 only for id: 1cf789ef, then count 2 during 13:18:17 - 13:18:21 for id: 1cf789ef and 3c05282c. Then I want it to be line chart.

Output should look like...

How do I achieve this?

[woodcock]

You need the concurrency command:

https://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Concurrency

[diavolo]

Thank you! I didn't know concurrency command. Very useful!!

[lquinn · Accepted solution]

If a line chart is the end goal, you could use concurrency to find the number of overlapping events, along with gentimes to create an event for every second. You will need to adjust the parameters of gentimes depending on the time you want your graph to show. This will not however list each individual id, only a count of the number of id's. Try the following search:

<your_current_search> | table id, current_time, end_time | eval starttime=strptime(current_time,"%Y/%m/%d %H:%M:%S") | eval endtime=strptime(end_time,"%Y/%m/%d %H:%M:%S") | eval duration = endtime-starttime | append [|gentimes start=01/21/2017:13:00:00 end=01/21/2017:15:00:00 increment=1s | eval type="gentimes" | eval duration=1] | concurrency start=starttime duration=duration | where type="gentimes" | eval concurrency=concurrency-1 | rename starttime AS _time | timechart span=1s max(concurrency) AS "Number of Id's"

[diavolo]

Great!!! This is exactly what I wanted.
Thank you!