Splunk Search

Summarize data

Kirthika
Path Finder
 
Labels (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

What have you tried so far and how did those results not meet expectations?

What is the unique identifier of a device?

---
If this reply helps you, Karma would be appreciated.
0 Karma

Kirthika
Path Finder

Summarize

0 Karma

richgalloway
SplunkTrust
SplunkTrust

How does that query work for you?

The OP mentioned "probe" and "device" and said there could be more than one probe ID for each device.  The example results table shows "Machineid" and "probeid" columns.  So, again I ask: What uniquely identifies a device?

The _time field in Splunk is in Linux epoch form - the number of seconds that have elapsed since 1 Jan 1970.  Adding up _time for several devices will produce a total_time value in the hundreds of years, which is unlikely to be correct or even helpful.

---
If this reply helps you, Karma would be appreciated.

Kirthika
Path Finder

Hi Richgalloway  What you said is correct. Total time value is hundred of years.. How to resolve this issue. Machine ID and Device ID are same. In sample I have mentioned as MachineID. It is unique id. Thanks in Advance

0 Karma

richgalloway
SplunkTrust
SplunkTrust

We don't have enough data to solve the problem.  While we have a time of day of each calculation, we do not have the duration of each calculation.  If we have start and end timestamps then we can determine the duration.

| eval radius = sqrt(pow(x,2)+pow(y,2))
|where radius > 0.8
|stats sum(duration) as total_time by Machineid
|sort 0 total_time
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...