Splunk Search

How to create a timechart with the count of open events that did not have a closing event within a certain time frame?

New Member

Hi there,

I have events which indicate opening and closing of an event. I want to see the amount of open events (that did not get a closing event by that time) at a given time.

Snipped from my search so far:

... | stats earliest(_time) as _time by processid, service, location | eval combkey = service." - ".processid | eval openclosed = if(location="o","close","open") | timechart...

I just have no idea how to achieve this.

Any idea is welcome 🙂

thanks
lordadmiral

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Try like this

.. | stats earliest(_time) as _time by processid, service, location | eval openclosed = if(location="o",-1,1) | timechart sum(openclosed)

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Try like this

.. | stats earliest(_time) as _time by processid, service, location | eval openclosed = if(location="o",-1,1) | timechart sum(openclosed)

View solution in original post

0 Karma

New Member

Thanks a lot somesoni2!

0 Karma

Legend

Have you tried ... | timechart span=15m count by openclosed

0 Karma

New Member

Thanks for answering sundareshr! somesoni2´s answer did the trick. 😉

0 Karma