Splunk Search

How to count and chart by minute an error exists, not the count of the number of errors? (ex: each minute = 1 count)

subtrakt
Contributor

Hi,

Anyone know what's the best way to count by minute the error exists, and not by the count of the number of errors?

I'm looking for the duration of errors and don't care about the volume. Each minute = 1 count

So an issue lasting 7 minutes has a count of 7.

Would that be with the eventstats command?

0 Karma

woodcock
Esteemed Legend

Let us assume that you have an status field that says either "Fail" or "Clear" (it could be "OK" or "Bad" or whatever; it doesn't really matter). You can do it like this:

... | streamstats current=f last(_time) AS nextTime by host | eval secondsInCurrentState = nextTime - _time | eval minutesInCurrentState = round(secondsInCurrentState /60, 0) | where status="Fail" | timechart span=1h count by minutesInCurrentState

This shows how many errors started in each hour of the day and counts them in buckets of minutes-of-duration. I believe that this is what you were asking but if it is not exactly, it should get you close.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!