Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How to count the number of events within a dynamic...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
I have logs with the following fields:
StartTime (which is used as _time)
Duration (in seconds)
The goal now is to count the number of events in the same timerange (_time + duration)
i.e.:
StartTime | Duration | EventNr
7/2/2015 8:45:00 AM | 3600 | 1
7/2/2015 8:50:00 AM | 600 | 2
7/2/2015 8:55:00 AM | 600 | 3
7/2/2015 9:10:00 AM | 1200 | 4
7/2/2015 10:00:00 AM | 1200 | 5
Range for Event #1 is from 8:45 to 9:45 -> 4 events in this timerange
Range for Event #2 is from 8:50 to 9:00 -> 2 events
...
Result should be a table:
EventNr | EventCount
1 | 4
2 | 2
...
Thanks,
Mathias
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can do this with the concurrency command like this:
... | concurrency duration=Duration output=EventCount
Here is another very "expensive" way to do it but it will work:
... | eval StartTime=_time | eaval EndTime = _time + Duration | map search="search _time>=$StartTime$ AND _time<=$EndTime$ | stats count AS EventCount | eval EventNr=$EventNr$"]
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can do this with the concurrency command like this:
... | concurrency duration=Duration output=EventCount
Here is another very "expensive" way to do it but it will work:
... | eval StartTime=_time | eaval EndTime = _time + Duration | map search="search _time>=$StartTime$ AND _time<=$EndTime$ | stats count AS EventCount | eval EventNr=$EventNr$"]
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Pls using eventstats calculation.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How many rows that might be processed by the search? How many distinct EventNr can exists?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It's a csv with 3000 events and each event has it's distinct EventNr
Splunk Observability for AI
Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...
Splunk Observability as Code: From Zero to Dashboard
