Splunk Search

Tstats command with span

Harikiranjammul
Explorer

I am running tstats command with span of 2hrs for index and source.

It returns the data for every 2hrs.

But I want to include the results only if it's available for every 2hrs in last 24hrs search.

So basically which is not having continuous data, want to ignore it.

How can I do this.

 

0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Is this the sort of thing you are looking for?

| tstats count by index source _time span=2h
| stats list(count) as counts dc(_time) as frequency list(_time) as times by index source
| where frequency>=12

View solution in original post

livehybrid
SplunkTrust
SplunkTrust

Hi @Harikiranjammul 

Edit - I see there have been other posts since I opened this thread but hopeful;ly this helps someone in the future or provides another option!

How about the following?

| tstats count 
    WHERE 
    earliest=-24h@h latest=@h index=* AND source=* 
    BY _time span=2h, index, source 
| stats dc(_time) as num_buckets  BY index, source
|where num_buckets = 12

livehybrid_0-1746599985013.png

 

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

0 Karma

kiran_panchavat
SplunkTrust
SplunkTrust

@Harikiranjammul 

kiran_panchavat_0-1746588954142.png

 

Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!

Harikiranjammul
Explorer

Thanks. Probably this helps

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Is this the sort of thing you are looking for?

| tstats count by index source _time span=2h
| stats list(count) as counts dc(_time) as frequency list(_time) as times by index source
| where frequency>=12
Get Updates on the Splunk Community!

Index This | What’s a riddle wrapped in an enigma?

September 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

BORE at .conf25

Boss Of Regular Expression (BORE) was an interactive session run again this year at .conf25 by the brilliant ...

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...