Splunk Query not working as expected

[Sunny]

Hi

Using following query:

`mbp_ocp4` kubernetes.container.name =*service* level=NG_SERVICE_PERFORMANCE SERVICE!=DPTDRetrieveArrangementDetail* | eval resp_time_exceeded = if(EXETIME>3000, "1","0")

|bin span=30m _time bins=2

| stats count as "total_requests", sum(resp_time_exceeded) as long_calls by kubernetes.namespace.name, kubernetes.container.name

| eval Percent_Exceeded = (long_calls/total_requests)*100

| where total_requests>200 and Percent_Exceeded>5

Getting results as shown below:

I use the following IN THE CODE ABOVE

|bin span=30m _time bins=2

BUT NOT GETTING so that the data is shown in 30 minutes increments?

How can I refine the query so that it shows 30 minute increments instead of all  at once?

Screenshot 2024-01-25 123918.png

[ITWhisperer]

You have bin'd _time but not included it in the by clause of your stats command

[Sunny]

Hi ITwhispper,

Thanks for getting back!!

Can you show what you mean in terms of where to add what you are saying?

Thanks

[yuanliu]

@ITWhisperer suggests to add it to the by clause. (Also known as groupby in Splunk lingo.) Literally just added it after by.  Something like

`mbp_ocp4` kubernetes.container.name =*service* level=NG_SERVICE_PERFORMANCE SERVICE!=DPTDRetrieveArrangementDetail* | eval resp_time_exceeded = if(EXETIME>3000, "1","0")

|bin span=30m _time bins=2

| stats count as "total_requests", sum(resp_time_exceeded) as long_calls by _time kubernetes.namespace.name, kubernetes.container.name

| eval Percent_Exceeded = (long_calls/total_requests)*100

| where total_requests>200 and Percent_Exceeded>5