Splunk Search

Time Chart - specifying/graphing time interval counts that dont accumulate



I've created three time charts that are currently counting the number of connections. Each time chart is set with different time ranges (1 hour, 4 hour and 24 hour). Here is what the search string looks like:

my-query| timechart count by built_connections

It's seems pretty straight forward but not actually what I'm after. What I actually need is to count the number of connections in 5 minute intervals and plot it on the graph without adding the total count of the first 5 minute interval to the next (and so on). So the first 0-5 minutes would count the number of connections and plot it on the chart. Then the next 5-10 minute interval would count the number of connection within that 5-10 minute interval and plot it on the graph and so on (I'd like to apply it to all three graphs for 1, 4 and 24 hours). What I don't want is to have the the 0-5 minute count added to the value for the next 5-10 minute interval and so on. Each 5 minute interval will have it's own unique count.

Hope this makes sense.


Tags (1)
0 Karma



my-query| timechart span=5min count by built_connections 

I think this is what is required correct.

0 Karma
Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...