Splunk Search

Time Chart - specifying/graphing time interval counts that dont accumulate

danielkhouri
Engager

Hi,

I've created three time charts that are currently counting the number of connections. Each time chart is set with different time ranges (1 hour, 4 hour and 24 hour). Here is what the search string looks like:

my-query| timechart count by built_connections

It's seems pretty straight forward but not actually what I'm after. What I actually need is to count the number of connections in 5 minute intervals and plot it on the graph without adding the total count of the first 5 minute interval to the next (and so on). So the first 0-5 minutes would count the number of connections and plot it on the chart. Then the next 5-10 minute interval would count the number of connection within that 5-10 minute interval and plot it on the graph and so on (I'd like to apply it to all three graphs for 1, 4 and 24 hours). What I don't want is to have the the 0-5 minute count added to the value for the next 5-10 minute interval and so on. Each 5 minute interval will have it's own unique count.

Hope this makes sense.

Thanks
Dan.

Tags (1)
0 Karma

vishaltaneja070
Motivator

@danielkhouri

my-query| timechart span=5min count by built_connections 

I think this is what is required correct.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...