Splunk Search

How to create a report to show an event occurring in the last minute, last 10 minutes, and since midnight?

Engager

I am looking to produce a report to show an event occurring in the last minute, last 10 minutes and since midnight:
eg:
event in the last minute 10
event in the last 10 minutes 32
event daily 1105

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Try like this (update the first line of search per your's, keep the same earliest and latest)

index=foo sourcetype=bar earliest=@d latest=@m
| eval period=case(_time>=relative_time(now(),"-1m@m"), "event in last minute",_time>=relative_time(now(),"-10m@m"), "event in last 10 minute",true(), "event daily")
| stats count by period

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Try like this (update the first line of search per your's, keep the same earliest and latest)

index=foo sourcetype=bar earliest=@d latest=@m
| eval period=case(_time>=relative_time(now(),"-1m@m"), "event in last minute",_time>=relative_time(now(),"-10m@m"), "event in last 10 minute",true(), "event daily")
| stats count by period

View solution in original post

0 Karma

Engager

Works great, thank you.

0 Karma