Splunk Search

How to count and chart by minute an error exists, not the count of the number of errors? (ex: each minute = 1 count)

subtrakt
Contributor

Hi,

Anyone know what's the best way to count by minute the error exists, and not by the count of the number of errors?

I'm looking for the duration of errors and don't care about the volume. Each minute = 1 count

So an issue lasting 7 minutes has a count of 7.

Would that be with the eventstats command?

0 Karma

woodcock
Esteemed Legend

Let us assume that you have an status field that says either "Fail" or "Clear" (it could be "OK" or "Bad" or whatever; it doesn't really matter). You can do it like this:

... | streamstats current=f last(_time) AS nextTime by host | eval secondsInCurrentState = nextTime - _time | eval minutesInCurrentState = round(secondsInCurrentState /60, 0) | where status="Fail" | timechart span=1h count by minutesInCurrentState

This shows how many errors started in each hour of the day and counts them in buckets of minutes-of-duration. I believe that this is what you were asking but if it is not exactly, it should get you close.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...