Splunk Search

How to write one search find the count for three different time frames without using append or multisearch?

Contributor

Hi,

Please help me sort this out.
I have a single search like index=test sourcetype= test...| stats count, but the trick here is I have to find the count for -30m@m, -15m@m and -5m@m....and the condition is we shouldn't use append or multisearch..it should run in a single query.

the output would look something like below:

count(last30min)  count(last15min)  count(last5m)
      xxx               xxxx            xxxxx

NOTE: it should run in a single search, no append or multisearch

Tags (3)
0 Karma
1 Solution

Builder

Hi,

You can create a field which identifies the time frame bucket. e.g.

..| eval currentTime=now() | eval timeBucket=if(_time > (currentTime-5mins), "5Mins", next conditions for 15 and 30 mins ) | stats count by timeBucket

Note: convert mins in seconds for comparision.

Thanks!!

View solution in original post

Builder

Hi,

You can create a field which identifies the time frame bucket. e.g.

..| eval currentTime=now() | eval timeBucket=if(_time > (currentTime-5mins), "5Mins", next conditions for 15 and 30 mins ) | stats count by timeBucket

Note: convert mins in seconds for comparision.

Thanks!!

View solution in original post

Splunk Employee
Splunk Employee

Can you explain why you have the condition banning append (and presumably appendcols) and subsearches?

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma

Contributor

The condition was the env we are using can run only 10 concurrent searches and i have already 9 searches in place so thats why we ignored append

0 Karma