Splunk Search

How to extract dates where no-traffic?

jp_duraimurugan
Engager

Hi All,

I want to extract the dates for last 1 month where there is no-traffic in my application using splunk query.

Please anyone help on this.

Labels (1)
Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Splunk searches for data that is there and can't find something that isn't there.  You can, however, use the timechart command to count events at intervals.  The command will automatically fill in a zero for each interval without an event.

 

<<your search for traffic>>
| timechart span=1d count
| where count=0

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

woodcock
Esteemed Legend

... | timechart count span=1mon ..., | fillnull value=0 count | where count==0

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try something like this. Replace base search in line 1 with your search that fetches your application traffic.

| tstats count WHERE index=_internal sourcetype=splunkd by _time span=1d 
| append 
    [| makeresults 
    | addinfo 
    | eval days=mvrange(relative_time(info_min_time,"@d"),relative_time(info_max_time,"@d")+1,86400) 
    | mvexpand days 
    | eval _time=round(days) 
    | eval count=0 
    | table _time count ] 
| stats max(count) as count by _time

richgalloway
SplunkTrust
SplunkTrust

Splunk searches for data that is there and can't find something that isn't there.  You can, however, use the timechart command to count events at intervals.  The command will automatically fill in a zero for each interval without an event.

 

<<your search for traffic>>
| timechart span=1d count
| where count=0

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...