Splunk Search

How to search the count of IDs processed for multiple response time ranges?


hi i have two fields: IDs and response time in seconds. so by using the response time, i need to break down events
0-1 sec how many IDs were processed (their count)
1-2 sec how many IDs were processed
9-10 sec how many IDs were processed

can someone help me thanks.

0 Karma
1 Solution


Thanks for your answer i got it by using the ceil and floor commands...thank you so much for your answers..it looks like it will also work for my case

0 Karma


Seems like you need the following, IDs processed every second (which in-turn will require you to run the search for shorter duration) :
your base search ID=* | timechart span=1s count(ID) as "IDs Processed"

If this is not what you need please provide field names and examples.

| makeresults | eval message= "Happy Splunking!!!"
0 Karma