Splunk Search

How to use the timechart command to get a certain amount of time span in custom field?

brdr
Contributor

I have a lookup table with 3 fields: host, user, p_time

The events in the lookup table will contain 12 months of data. I have converted p_time to epoch format.

Simply, what I'm trying to accomplish is to use timechart command with a span of 1 month using p_time - to view the total number of events each month. As a side note, I would also like to include total number of events over 12 month period.

Any help would be appreciated.

Tags (3)
1 Solution

woodcock
Esteemed Legend

Just add this to the bottom of your existing search:

| eval _time = p_time
| timechart span=1mon count

View solution in original post

woodcock
Esteemed Legend

Just add this to the bottom of your existing search:

| eval _time = p_time
| timechart span=1mon count

somesoni2
SplunkTrust
SplunkTrust

And add following after the timechart command to get total events for whole 12 month period

| eventstats sum(count) as TotalEvents
0 Karma

brdr
Contributor

Awesome. thank you both (as always) for responding 🙂

0 Karma

woodcock
Esteemed Legend

Nice tag-team, @somsoni2. So now you and @daljeanis are both stalking me and fixing my silly oversights and mistakes. Thanks for picking up my slack.

macadminrohit
Contributor

Is there another slack than the splunk user group slack ?

0 Karma

xpac
SplunkTrust
SplunkTrust

Yeah, the idiom "Pick up someones slack" 😉

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...