Splunk Search

Splunk Table with data from multiple points in time

TedWhite
Engager

I have a datasource that drops data into Splunk every 10 minutes that contains data about my team's workflow.

The data in Splunk looks something like this

10:00am "Priority" = 10

10:00am "Normal" = 100

10:10am "Priority" = 8

10:10am "Normal" = 102

10:20am "Priority" = 12

10:20am "Normal" = 95

etc.

I want to create a table that looks like this:

Priority Type, Tickets Now, Tickets 1 hour ago, Tickets 24 hours ago

Normal,95,100,103

Priority,12,,10,8

 

My search is:

 

index="data" source="log" earliest=-12hr

TicketPriority= "Normal" OR "Priority"
| bin field3 span=10m
| dedup TicketPriority
| stats values(field3) by TicketPriority

 

How can I get it to add the numbers of tickets from 1 hour ago and 24 hours ago?

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Assuming you have a _time field and field3 is your count

index="data" source="log" earliest=-24hr
TicketPriority= "Normal" OR "Priority"
| bin _time span=10m
| eval bucket=round((now() - _time) / (60 * 10), 0)
| where bucket IN ( 0, 6, 144 )
| eval bucket=case(0,"Tickets now", 6, "Tickets 1 hour ago", 144, "Tickets 24 hours ago")
| chart values(field3) by TicketPriority bucket

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming you have a _time field and field3 is your count

index="data" source="log" earliest=-24hr
TicketPriority= "Normal" OR "Priority"
| bin _time span=10m
| eval bucket=round((now() - _time) / (60 * 10), 0)
| where bucket IN ( 0, 6, 144 )
| eval bucket=case(0,"Tickets now", 6, "Tickets 1 hour ago", 144, "Tickets 24 hours ago")
| chart values(field3) by TicketPriority bucket
0 Karma

TedWhite
Engager

Perfect, thanks exactly what I needed.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...