Splunk Search

How to use search time range in stats?

yuanliu
Builder
field=value earliest=-7d@d latest=@d

When there are many events in these 7 days, I can use earliest(_time) and latest(_time) (or if I'm lucky with data, even last(_time), first(_time)) to determine the time range, thereby determine frequency. But when events are sparse, these functions differ too much from the specified earliest and latest time boundaries. I initially thought _span was available in stats, but it is not. How can I access the time range in stats?

0 Karma
1 Solution

Ayn
Legend

If you mean how to get which timerange the search was run across, use the addinfo command which adds fields with this information. See: http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Addinfo

View solution in original post

Ayn
Legend

If you mean how to get which timerange the search was run across, use the addinfo command which adds fields with this information. See: http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Addinfo

View solution in original post

yuanliu
Builder

addinfo is it. Thanks @Ayn

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi yuanliu,

If you're after the span in stats do something like this

field=value .... | bucket _time span=1d | stats count by field, _time

Hope this helps to get you going ...

cheers, MuS

0 Karma

Raghav2384
Motivator

How about a Parent Search like : .....|stats count by field1,field2,field3,field4,field5,_time and the child search

search base="Parent and use Timechart here?

Pardon me if i am going tangents.

0 Karma