Splunk Search

Timechart distribution of stats count result

jgcsco
Path Finder

I am trying to do the following search:

Log file looks like

2012-12-01 11:00:00 id=B starttime=2012-12-02T08:00:00 length=100
2012-12-01 11:00:00 id=C starttime=2012-12-02T08:00:00 length=150
2012-12-01 11:00:00 id=A starttime=2012-12-02T08:00:01 length=100
2012-12-01 11:00:00 id=D starttime=2012-12-02T08:00:00 length=110
2012-12-01 11:00:00 id=C starttime=2012-12-02T08:00:20 length=100
2012-12-01 11:00:00 id=A starttime=2012-12-02T08:00:00 length=200
....

First, I need to find out how many unique values of "id + starttime + length"

mysearch| eval output = (id + ";" + starttime + ";" + length)  | stats count AS key by output 

Then I would like to find out on an hourly basis, the distribution of the key, e.g. how many keys occurred once, twice, 10, 20, etc.. hourly?

I have been struggling with it. Any suggestions?

Thanks

0 Karma
1 Solution

somesoni2
Revered Legend

Try something like this

Yoursearch   | bucket _time span=1h | eval output= (id + ";" + starttime + ";" + length) | stats count as KeyCount  by _time output | eventstats dc(output) as UniqueKeys

View solution in original post

somesoni2
Revered Legend

Try something like this

Yoursearch   | bucket _time span=1h | eval output= (id + ";" + starttime + ";" + length) | stats count as KeyCount  by _time output | eventstats dc(output) as UniqueKeys

jgcsco
Path Finder

thanks, will give it a try!

0 Karma

jensonthottian
Contributor

Use this -
mysearch | bucket _time span=1h | eval output = (id + ";" + starttime + ";" + length) |stats count by _time,output.

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...