Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: How to show data in a range grouped by specifi...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
i have below data. i want to represent in a range to group date for 5 days and i want date field to represent(16-08-16 - 16-08-30) count. pls help
date count
16-08-26 14
16-08-27 4
16-08-28 14
16-08-29 30
16-08-30 34
16-08-31 30
16-09-01 6
16-09-02 4
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
not knowing if you want 5 or 15 days yet, i have written this:
| eval earliest=relative_time(_time,"@mon-16d@d") |eval latest=relative_time(earliest,"+15d@d")|eval time=strftime(earliest,"%y-%m-%d")+" - "+strftime(latest,"%y-%m-%d")
and you can use time as the field to bucket by. you can adjust the values in the relative_time evals to meet your needs, if you really want only 5 days. these will bring you "17-08-16 - 17-08-31" for example.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
not knowing if you want 5 or 15 days yet, i have written this:
| eval earliest=relative_time(_time,"@mon-16d@d") |eval latest=relative_time(earliest,"+15d@d")|eval time=strftime(earliest,"%y-%m-%d")+" - "+strftime(latest,"%y-%m-%d")
and you can use time as the field to bucket by. you can adjust the values in the relative_time evals to meet your needs, if you really want only 5 days. these will bring you "17-08-16 - 17-08-31" for example.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks. worked perfectly !
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Awesome, i'm glad, just make sure to spot check that the counts all match! I'm sure you already did, but i just like to double check when doing aggregates!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
do you mean 16-08-26 - 16-08-30 for a 5 day span or 16-08-16 - 16-08-30 for a 15 day span?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
5 days span
Dashboards: Hiding charts while search is being executed and other uses for tokens
Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...
Brains, Bytes, and Boston: Learn from the Best at .conf25
