Splunk Search

Increase count by 1 for every 10 Minutes

New Member

Hi All,

index="XXX" |stats latest(time) as lastseen,values(ID) as ID, count by IPAdd | eval Filter=if(count%2==0,"Even","Odd") | search Filter="Odd" |eval hourssince=(now()-lastseen) | convert timeformat="%d-%b-%y %H:%M" ctime(lastseen) | eval readable = tostring(hourssince, "duration") | sort - lastseen | rename readable as "Running for: Days+:HH:MM:SS", lastseen as "Started",IPAdd as "IP" | table ID IP Started "Running for: Days+:HH:MM:SS" count |

How do i increase count to +1 for every let's say 10 minutes that shows on duration until the stop event is received?

Thanks!!

0 Karma

Splunk Employee
Splunk Employee

To increase count by 1 from its original value, use a counter with streamstats on a bucket of 10m:

| bucket last_seen AS last_bucket span=10m | streamstats dc(last_bucket) AS counter | eval count=count+counter
0 Karma

SplunkTrust
SplunkTrust

You would need to explain more about your use case with sample data as to what start event and end event look like. Also can you not use end epoch time - start epoch time to get duration as seconds and then divide by 600 To convert it to 10 minutes?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma