Splunk Search

How to get the count of the last 30 days, for a 15 min period for each day- without using dc

dwibedi03
Explorer

My index is getting refreshed every 15 mins and new data gets populated every 15 mins.
I need to count the events for the last 15 mins for each day in a period of 30 days.

Currently, I am doing dc(field) for each day but it removes all the duplicates events and my count is not what I want.

I want to get the count of the last 30 days for a 15 mins period for each day without using dc.

Tags (3)
0 Karma
1 Solution

woodcock
Esteemed Legend

Like this (run for Last 30 days)?

... | timechart span=15m count BY source and maybe other fields here
| eval day = strftime(_time, "%Y%m%d")
| reverse
| dedup day

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this (run for Last 30 days)?

... | timechart span=15m count BY source and maybe other fields here
| eval day = strftime(_time, "%Y%m%d")
| reverse
| dedup day
0 Karma

richgalloway
SplunkTrust
SplunkTrust

dc is short for distinct_count, which counts the number of unique values, hence duplicates are not counted.
Consider using c or count, instead.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

dwibedi03
Explorer

I was doing count and it was giving a sum of whole day

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>