Splunk Search

Show min/max of one column with top/count

atamido
New Member

The data I have looks like this:

Time    Shape   Color
12:00   square  green
12:01   circle  blue
12:02   square  blue
12:03   circle  green
12:04   square  green
12:05   circle  blue
12:06   square  green
12:07   circle  blue
12:08   square  green
12:09   circle  green

I would like something similar to the TOP view that shows Shape/Color/Count/Percent. But I would also like to see the min/max of the times for each of those also, so I can see the first and last times of each of those combinations. So the outgoing chart might look like:

Shape   Color  Count  Percent  Begin  End
square  green      4      40%  12:00  12:08
circle  blue       3      30%  12:01  12:07
circle  green      2      20%  12:03  12:09
square  blue       1      10%  12:02  12:02
Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Try this:

base search | stats count as Count earliest(_time) as Begin latest(_time) as End by Shape Color 
| eventstats sum(Count) as Total | eval Percent = round(Count/Total*100,2)."%"
| table Shape Color Count Percent Begin End

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Try this:

base search | stats count as Count earliest(_time) as Begin latest(_time) as End by Shape Color 
| eventstats sum(Count) as Total | eval Percent = round(Count/Total*100,2)."%"
| table Shape Color Count Percent Begin End

View solution in original post

atamido
New Member

Amazing, that's exactly what I wanted. I added some time converts and a sort to act just like TOP, and I'm done.

base search | stats count as Count earliest(_time) as Begin latest(_time) as End by Shape Color
| eventstats sum(Count) as Total | eval Percent = round(Count/Total*100,2)."%"
| convert ctime(Begin) as Begin | convert ctime(End) as End | sort Count DESC
| table Shape Color Count Percent Begin End

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!