Splunk Search
Highlighted

How to create a report to show an event occurring in the last minute, last 10 minutes, and since midnight?

Engager

I am looking to produce a report to show an event occurring in the last minute, last 10 minutes and since midnight:
eg:
event in the last minute 10
event in the last 10 minutes 32
event daily 1105

0 Karma
Highlighted

Re: How to create a report to show an event occurring in the last minute, last 10 minutes, and since midnight?

SplunkTrust
SplunkTrust

Try like this (update the first line of search per your's, keep the same earliest and latest)

index=foo sourcetype=bar earliest=@d latest=@m
| eval period=case(_time>=relative_time(now(),"-1m@m"), "event in last minute",_time>=relative_time(now(),"-10m@m"), "event in last 10 minute",true(), "event daily")
| stats count by period

View solution in original post

0 Karma
Highlighted

Re: How to create a report to show an event occurring in the last minute, last 10 minutes, and since midnight?

Engager

Works great, thank you.

0 Karma