Splunk Search

Multiple key value pairs in a timechart based on the counts of 2 fields

datatan
Engager

Here's an example of some error logs that simply show which app reported an error and which country:

_time(s)sourcetypecountry
0app1US
1app1DE
2app2DE
65app2US
66app2US
67app1DE

 

Here's the timechart I would like to retrieve(span=1m):

_timeapp1app2
2021-09-30 00:00:00{"US": 1, "DE": 1}{"DE": 1}
2021-09-30 00:01:00{"DE": 1}{"US": 2}

 

Is this, or something similar, possible?

Labels (4)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Here is a runanywhere example - the part before the blank lines just sets up the dummy data

| makeresults
| eval _raw="_time(s)	sourcetype	country
0	app1	US
1	app1	DE
2	app2	DE
65	app2	US
66	app2	US
67	app1	DE"
| multikv forceheader=1
| eval _time=relative_time(_time,"@m")+time_s_
| bin _time span=1m



| stats count by _time sourcetype country
| eval results="\"".country."\": ".count
| stats values(results) as results by _time sourcetype
| eval results="{".mvjoin(results,", ")."}"
| xyseries _time sourcetype results
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...