Splunk Search

Time Chart - specifying/graphing time interval counts that dont accumulate

danielkhouri
Engager

Hi,

I've created three time charts that are currently counting the number of connections. Each time chart is set with different time ranges (1 hour, 4 hour and 24 hour). Here is what the search string looks like:

my-query| timechart count by built_connections

It's seems pretty straight forward but not actually what I'm after. What I actually need is to count the number of connections in 5 minute intervals and plot it on the graph without adding the total count of the first 5 minute interval to the next (and so on). So the first 0-5 minutes would count the number of connections and plot it on the chart. Then the next 5-10 minute interval would count the number of connection within that 5-10 minute interval and plot it on the graph and so on (I'd like to apply it to all three graphs for 1, 4 and 24 hours). What I don't want is to have the the 0-5 minute count added to the value for the next 5-10 minute interval and so on. Each 5 minute interval will have it's own unique count.

Hope this makes sense.

Thanks
Dan.

Tags (1)
0 Karma

vishaltaneja070
Motivator

@danielkhouri

my-query| timechart span=5min count by built_connections 

I think this is what is required correct.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...