Splunk Search

How to count and chart by minute an error exists, not the count of the number of errors? (ex: each minute = 1 count)

subtrakt
Contributor

Hi,

Anyone know what's the best way to count by minute the error exists, and not by the count of the number of errors?

I'm looking for the duration of errors and don't care about the volume. Each minute = 1 count

So an issue lasting 7 minutes has a count of 7.

Would that be with the eventstats command?

0 Karma

woodcock
Esteemed Legend

Let us assume that you have an status field that says either "Fail" or "Clear" (it could be "OK" or "Bad" or whatever; it doesn't really matter). You can do it like this:

... | streamstats current=f last(_time) AS nextTime by host | eval secondsInCurrentState = nextTime - _time | eval minutesInCurrentState = round(secondsInCurrentState /60, 0) | where status="Fail" | timechart span=1h count by minutesInCurrentState

This shows how many errors started in each hour of the day and counts them in buckets of minutes-of-duration. I believe that this is what you were asking but if it is not exactly, it should get you close.

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...