Splunk Search

Search results help in getting hourly results?

kc_prane
Communicator

Hi I am using the below query and i need the results in hourly basis for the time i selected ?

 

"My Base search"   | fields TRAN_TIME_MS PAGE_ID PAGE_TITLE _time| eventstats perc99(TRAN_TIME_MS) as Percentile by PAGE_ID | where TRAN_TIME_MS <= Percentile | stats count avg(TRAN_TIME_MS) as avg_time max(TRAN_TIME_MS) as max_time by PAGE_ID,PAGE_TITLE, | eval avg_time=round(avg_time/1000,2) | eval max_time=round(max_time/1000,2)
| rename count as Total_Requests avg_time as Average(Seconds) max_time as Max_Time(Seconds) PAGE_ID as Page_ID PAGE_TITLE as Page_Description

 

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

To get the results broken down by hour, first use the bucket command to group results into the hour they occur.  Then add _time as a group in the stats command.

"My Base search"
| fields TRAN_TIME_MS PAGE_ID PAGE_TITLE _time
| eventstats perc99(TRAN_TIME_MS) as Percentile by PAGE_ID 
| where TRAN_TIME_MS <= Percentile 
| bucket span=1h _time
| stats count avg(TRAN_TIME_MS) as avg_time max(TRAN_TIME_MS) as max_time by _time, PAGE_ID,PAGE_TITLE, 
| eval avg_time=round(avg_time/1000,2) 
| eval max_time=round(max_time/1000,2)
| rename count as Total_Requests avg_time as Average(Seconds) max_time as Max_Time(Seconds) PAGE_ID as Page_ID PAGE_TITLE as Page_Description

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

kc_prane
Communicator

Thanks @richgalloway this Helps.

 

richgalloway
SplunkTrust
SplunkTrust

To get the results broken down by hour, first use the bucket command to group results into the hour they occur.  Then add _time as a group in the stats command.

"My Base search"
| fields TRAN_TIME_MS PAGE_ID PAGE_TITLE _time
| eventstats perc99(TRAN_TIME_MS) as Percentile by PAGE_ID 
| where TRAN_TIME_MS <= Percentile 
| bucket span=1h _time
| stats count avg(TRAN_TIME_MS) as avg_time max(TRAN_TIME_MS) as max_time by _time, PAGE_ID,PAGE_TITLE, 
| eval avg_time=round(avg_time/1000,2) 
| eval max_time=round(max_time/1000,2)
| rename count as Total_Requests avg_time as Average(Seconds) max_time as Max_Time(Seconds) PAGE_ID as Page_ID PAGE_TITLE as Page_Description

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...