Splunk Search

Time Chart - specifying/graphing time interval counts that dont accumulate

danielkhouri
Engager

Hi,

I've created three time charts that are currently counting the number of connections. Each time chart is set with different time ranges (1 hour, 4 hour and 24 hour). Here is what the search string looks like:

my-query| timechart count by built_connections

It's seems pretty straight forward but not actually what I'm after. What I actually need is to count the number of connections in 5 minute intervals and plot it on the graph without adding the total count of the first 5 minute interval to the next (and so on). So the first 0-5 minutes would count the number of connections and plot it on the chart. Then the next 5-10 minute interval would count the number of connection within that 5-10 minute interval and plot it on the graph and so on (I'd like to apply it to all three graphs for 1, 4 and 24 hours). What I don't want is to have the the 0-5 minute count added to the value for the next 5-10 minute interval and so on. Each 5 minute interval will have it's own unique count.

Hope this makes sense.

Thanks
Dan.

Tags (1)
0 Karma

vishaltaneja070
Motivator

@danielkhouri

my-query| timechart span=5min count by built_connections 

I think this is what is required correct.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Picture this. You arrive at .conf26 already having your socializing and networking plans mapped out. No ...

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence

Implementing Zero Trust (ZT) across complex environments often falters at the very beginning due to a ...