Splunk Search

How to sum the values in a field over a specific time span?

chatham
Engager

New to splunk!

I'm currently having trouble trying to sum values in a field over a specific time span...

My search:

*HttpRequestProcessor | rex field=LogLine "(?<Time>\s\d+\s)" | rex field=TimeStamp_Thread "(?<dt2>[\d]{4}-[\d]{2}-[\d]{2} [\d]{1,2}:[\d]{1,2}[\d]{1,2}:[\d]{2}.[\d]{3})"  | convert num(Time)    | eval time5=strptime(dt2,"%Y-%m-%d %H")  | eval _time=time5  | bucket _time span=1h | stats count(Time) by _time

instead of count(Time) what I really want is sum(Time) however, when I use that syntax, no stats are returned...what am I missing here?

Thanks!

Tags (3)
1 Solution

sk314
Builder

As extracted by your regex, Time has spaces in it. May be that's why sum fails.

Try this instead:

 *HttpRequestProcessor | rex field=LogLine "\s(?<Time>\d+)\s" | rex field=TimeStamp_Thread "(?<dt2>[\d]{4}-[\d]{2}-[\d]{2} [\d]{1,2}:[\d]{1,2}[\d]{1,2}:[\d]{2}.[\d]{3})"  | convert num(Time)    | eval time5=strptime(dt2,"%Y-%m-%d %H")  | eval _time=time5  | bucket _time span=1h | stats sum(Time) by _time

View solution in original post

sk314
Builder

As extracted by your regex, Time has spaces in it. May be that's why sum fails.

Try this instead:

 *HttpRequestProcessor | rex field=LogLine "\s(?<Time>\d+)\s" | rex field=TimeStamp_Thread "(?<dt2>[\d]{4}-[\d]{2}-[\d]{2} [\d]{1,2}:[\d]{1,2}[\d]{1,2}:[\d]{2}.[\d]{3})"  | convert num(Time)    | eval time5=strptime(dt2,"%Y-%m-%d %H")  | eval _time=time5  | bucket _time span=1h | stats sum(Time) by _time

chatham
Engager

Genius! That worked! Thanks a lot, sk314!

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...