Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Timechart with sum at single value level
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunkers!
Need your help...
I created a search piping the following fields (simplified)
_time AppID Incident_duration
I have to group incidents duration by week, running a timechart, at AppID level:
| timechart span=1w values(AppID) as AppID, sum(incident_duration) as Weekly_Inc_duration
Unfortunately, returned AppID field is a multivaluefield (whenever in the same week there are multiple AppID with an incident event) and in this case Weekly_Inc_duration is the sum of the duration for all those AppIDs.
I'd like to get as output the sum at AppID level.
Can you help me?
Tks!
CArmine
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hey
looking at your comments section you can try
| eval dateyearweek=strftime(_time,"%Y-%U") | stats sum(incident_duration) as Weekly_Inc_duration BY AppID dateyearweek
Depending of your country, you have 2 variations :
%U is replaced by the week number of the year (Sunday as the first day of the week) as a decimal number [00,53].
%V is replaced by the week number of the year (Monday as the first day of the week) as a decimal number [01,53]. If the week containing 1 January has four or more days in the new year, then it is considered week 1. Otherwise, it is the last week of the previous year, and the next week is week 1.
Let me know if this helps!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hey
looking at your comments section you can try
| eval dateyearweek=strftime(_time,"%Y-%U") | stats sum(incident_duration) as Weekly_Inc_duration BY AppID dateyearweek
Depending of your country, you have 2 variations :
%U is replaced by the week number of the year (Sunday as the first day of the week) as a decimal number [00,53].
%V is replaced by the week number of the year (Monday as the first day of the week) as a decimal number [01,53]. If the week containing 1 January has four or more days in the new year, then it is considered week 1. Otherwise, it is the last week of the previous year, and the next week is week 1.
Let me know if this helps!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Do you mean like:
| timechart span=1w sum(incident_duration) as Weekly_Inc_duration BY AppID
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is an option,
but I'd like to get a tabular output, like
incident duration AppID Weekly_Inc_duration
in order to have the chance afterwards to append some further column and import this search as DataSet for further processing.
Tks!
Carmine
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Probably i found the solution
Timechart was the wrong way to create the dataset i was looking for.
I add within the search the calculation of fa field, dateweek_year, extracting Year+Week from _time
Than i simply run the stats command, in this way
| stats sum(incident_unavailability) as Unavailability by dateweek_year, CI
It seems to work 🙂
New Year. New Skills. New Course Releases from Splunk Education
Splunk and TLS: It doesn't have to be too hard
Faster Insights with AI, Streamlined Cloud-Native Operations, and More New Lantern ...
