Splunk Search

Tstats command with span

Harikiranjammul
Explorer

I am running tstats command with span of 2hrs for index and source.

It returns the data for every 2hrs.

But I want to include the results only if it's available for every 2hrs in last 24hrs search.

So basically which is not having continuous data, want to ignore it.

How can I do this.

 

0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Is this the sort of thing you are looking for?

| tstats count by index source _time span=2h
| stats list(count) as counts dc(_time) as frequency list(_time) as times by index source
| where frequency>=12

View solution in original post

livehybrid
Super Champion

Hi @Harikiranjammul 

Edit - I see there have been other posts since I opened this thread but hopeful;ly this helps someone in the future or provides another option!

How about the following?

| tstats count 
    WHERE 
    earliest=-24h@h latest=@h index=* AND source=* 
    BY _time span=2h, index, source 
| stats dc(_time) as num_buckets  BY index, source
|where num_buckets = 12

livehybrid_0-1746599985013.png

 

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

0 Karma

kiran_panchavat
Influencer

@Harikiranjammul 

kiran_panchavat_0-1746588954142.png

 

Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!

Harikiranjammul
Explorer

Thanks. Probably this helps

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Is this the sort of thing you are looking for?

| tstats count by index source _time span=2h
| stats list(count) as counts dc(_time) as frequency list(_time) as times by index source
| where frequency>=12
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...