Is there any way to use another time field than timestamp to group information by week?
I tried to create a new time field known for splunk with strptime function and use it to group the information in weeks through bucket and chart commands without success.
Query example:
sourcetype="peticionesh_proceso_negocio" | eval DemoTime = strptime(InitialTime,"%Y-%m-%d %H:%M:%S.%l") | table _time, DemoTime, InitialTime
Data output example:
ID Timestamp (_time) DemoTime InitialTime
1 6/8/12 12:45:00.950 PM 1345413600.000000 2012-08-20 00:00:00.000
2 6/8/12 12:45:00.253 PM 1341180000.000000 2012-07-02 00:00:00.000
3 6/8/12 12:44:59.350 PM 1342994400.000000 2012-07-23 00:00:00.000
4 6/8/12 12:44:58.013 PM 1340575200.000000 2012-06-25 00:00:00.000
Commands used:
... | chart f(x) DemoTime span=1w
… | bucket DemoTime span=1w
Any help to solve this problem is appreciated. Thanks.
This doesn't work?
sourcetype="peticionesh_proceso_negocio" | eval DemoTime = strptime(InitialTime,"%Y-%m-%d %T.%q) | bin span=7d DemoTime | stats f(x) by DemoTime
This doesn't work?
sourcetype="peticionesh_proceso_negocio" | eval DemoTime = strptime(InitialTime,"%Y-%m-%d %T.%q) | bin span=7d DemoTime | stats f(x) by DemoTime
I changed it back so you could see the old search. bin and bucket are the same command, the main difference was the use of stats and the split by DemoTime.
I swear that yesterday you indicated another solution that include bin command and grouping by week.
sourcetype="peticionesh_proceso_negocio" | eval DemoTime = strptime(InitialTime,"%Y-%m-%d %H:%M:%S.%l") | bin DemoTime span=1w as weeks | chart count by weeks
What is the difference between bucket and bin command? it’s supposed to be an alias for bucket command