Splunk Search

Stats Count Field To Include 0 For each Bin period

sssplunker
Engager

I’m trying to get a count for activity on around 10 different APIs.

The search is:

index=api_logs | bin span=5min _time | stats count by _time, APIName

Is it possible to use stats count so the output includes an entry for each API in each 10 minute period and report a ‘0’ if there hasn’t been a call. I know you could chart it but I’d like the data in this particular format.

 

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try this

| timechart span=5m count by APIName
| untable _time APIName count

View solution in original post

0 Karma

sssplunker
Engager

Thanks - I know it could be charted like that but that changes the structure of the data. I’d like to output the results in the three columns that stats count produces, so _time, APIname & count.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try this

| timechart span=5m count by APIName
| untable _time APIName count
0 Karma

sssplunker
Engager

Thanks!

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The timechart command will fill in the missing time periods.

| timechart span=5m count by APIName
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...