How to timechart events that occurred once in the last 5 minutes and more than once in the past 24 hours

[DavidHourani]

Hello Splunkers,

The question here is straightforwarder 😛

How can I count on a timechart of events that occurred once in the last 5 minutes and more than once in the past 24 hours? The result would be a chart with each point corresponding to that time's number of events that "appears once in the last 5min and more than once in the past 24hours".

My goal is to have both a chart and a single value with a trend.

Please help!

Regards,
David

[skoelpin]

I would create a subsearch to do this. Try this

index=YourIndex FIELD="*" earliest=-5m@m latest=@m| timechart  | stats count | where count = 1  [ search index=YourIndex FIELD="*" earliest=-24h@h latest=@h | bucket _time span=1d | stats count by _time | where count > 1]

Edit: I laughed out loud at your forwarder joke, super corny

[ppablo]

RE: Edit

So did I ;D

[DavidHourani]

lol shit happens when u splunk a lot..
So i tried what you wrote above the "|timechart" thing gives me an error, is there something after that's missing ?
From other posts i got the following so far:

index=MyIndex shost="*" earliest=-24h@h latest=now [index=MyIndex  shost="*"| stats latest(_time) as latest by shost| where latest > relative_time(now(), "-5min") | fields shost] | timechart span=5m count

What I'm trying to do is to check each 5 minutes how many new shost have had multiple connections in the past 24 hours and chart their number. What I'm getting is each 5 mins the behavior of the new shosts that appeared in the last 5 minutes over the past 24 hours