Splunk Search

Show count by a field value

Karthikeyan
Engager

Hi Experts,

I have a requirement to in which a table is ingested to Splunk. And the table has a field named Time showing timestamp as "YYYY-MM-DD HH:MM:SS:milisec". Data ingestion is happening without any issues. When I tried to show the count of events in a particular day

1. With stats command, the count is is matching with source, but there are times when there is no event happens in source system and that day count is not showing as 0 in Splunk, its just ignored.

2. With time command, Splunk takes the ingested timestamp of the event and not the timestamp in the event, and the count is not matching. Whereas, here when there is no data gets ingested, the count is showing as 0.

Please help me with this issue, where the count should be calculated with the field Time and in case if there is no event for a day, that should get displayed as 0. I'm trying to show the data in a bar chart.

 

Any help is much appreciated. Thanks.

Regards, Karthikeyan.SV

Labels (3)
0 Karma

Karthikeyan
Engager

Since this is ingested as a table, no new source are generated and hence we could see not count values. Apart from time field, there are other unique fields such as EXECUTION_HASH, EXECUTION_ID, with which I tried to do a count, but couldn't get desired result.

Search query:
| eval _time=TIME
| timechart count by EXECUTION_ID

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The stats command counts events.  If data from a certain source is absent then it is not counted.

The timechart command also counts events, but will automatically (unless told otherwise) fill in zeroes for time periods with no data.  Again, if a source is completely absent then it cannot be counted.

The timechart command requires the _time field for it to work.  You can, however, set _time to any other field you have.

... | eval _time=Time
| timechart count by source

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

Karthikeyan
Engager

Hi,

We use below search query to find the count

index="index" sourcetype="source_events"
| eval time=strptime(TIME,"%Y-%m-%d %H:%M:%S.%Q")
| eval date = strftime(time,"%Y-%m-%d")
|timechart span=1d count(date)

 

When I tried with the provided search command, didn't get the output.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...