Summarize data

[richgalloway]

What have you tried so far and how did those results not meet expectations?

What is the unique identifier of a device?

[Kirthika]

Summarize

[richgalloway]

How does that query work for you?

The OP mentioned "probe" and "device" and said there could be more than one probe ID for each device.  The example results table shows "Machineid" and "probeid" columns.  So, again I ask: What uniquely identifies a device?

The _time field in Splunk is in Linux epoch form - the number of seconds that have elapsed since 1 Jan 1970.  Adding up _time for several devices will produce a total_time value in the hundreds of years, which is unlikely to be correct or even helpful.

[Kirthika]

Hi Richgalloway  What you said is correct. Total time value is hundred of years.. How to resolve this issue. Machine ID and Device ID are same. In sample I have mentioned as MachineID. It is unique id. Thanks in Advance

[richgalloway]

We don't have enough data to solve the problem.  While we have a time of day of each calculation, we do not have the duration of each calculation.  If we have start and end timestamps then we can determine the duration.

| eval radius = sqrt(pow(x,2)+pow(y,2))
|where radius > 0.8
|stats sum(duration) as total_time by Machineid
|sort 0 total_time