Splunk Search

Splunk chart for time interval

aditya22
New Member

HI ,

I am trying to get the number of hits of users for very 3 minutes .

And am able to generate the chart with below command.

index=jira source="/opt/access_log.2020-04-23" host="xyz | bucket _time span=3m | chart count over user by _time

This generated the table but when viewing the events the events are showing only for a particular time and not time span.

eg:Its showing events for 12:00 but i need 12:00 to 12:03?

Can anyone tell what am i doing wrong?

Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The bucket command "rounds off" the time to the start of the interval. You'll see events for 12:00, 12:03, 12:06, etc. rather than 12:00, 12:01, 12:02 and so on.

You can try timechart, but you'll likely get the same results.

index=jira source="/opt/access_log.2020-04-23" host="xyz" | timechart span=3m count by user
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The bucket command "rounds off" the time to the start of the interval. You'll see events for 12:00, 12:03, 12:06, etc. rather than 12:00, 12:01, 12:02 and so on.

You can try timechart, but you'll likely get the same results.

index=jira source="/opt/access_log.2020-04-23" host="xyz" | timechart span=3m count by user
---
If this reply helps you, Karma would be appreciated.
0 Karma

aditya22
New Member

Thanks much for the response.

index=jira source="/opt/access_log.2020-04-23" host="xyz | bucket _time span=3m | chart count over user by _time

But getting error.

Error in 'timechart' command: You must specify data field(s) to chart.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The error doesn't match the query. There is no timechart command in the query.

---
If this reply helps you, Karma would be appreciated.
0 Karma

aditya22
New Member

oh sorry missed that.

This was the query.

index=jira source="/opt/access_log.2020-04-23" host="xyz | timechart span=3m | chart count over user by _time

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please look closely at my answer. bucket and chart are replaced by timechart.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...