Splunk Search

snap to 10 minutes

dadi
Path Finder

Hi ,
I want to snap to 10 minutes.
I know how to snap to an hour for example:
... | eval _time=relative_time(_time,"@h")

However, this doesn't work for 10 minutes time. Is there any other way to do it?

Thanks

Tags (1)
0 Karma
1 Solution

jonuwz
Influencer

You're probably looking for the bin/bucket command :

It "bins" values into discrete sets (or buckets)

This should do it.

... | bin _time span=10m  | ...

John

View solution in original post

morethanyell
Builder

Making time snap to the next 10th minute

| makeresults 
| eval now = now() 
| eval now_snapped_to_next_10th_min = relative_time(now(), 
    [| makeresults 
    | eval now = now() 
    | convert ctime(now) 
    | rex field=now "\d(?<min>\d)\:(?:\d{2})$" 
    | eval min = 10 - min 
    | eval min = if(min == 10, 0, min) 
    | eval adder = "\"+" . tostring(min) . "m@m\"" 
    | return $adder])
| convert ctime(now*) timeformat="%F %X"
0 Karma

charleswheelus
Path Finder

jonuwz
Influencer

You're probably looking for the bin/bucket command :

It "bins" values into discrete sets (or buckets)

This should do it.

... | bin _time span=10m  | ...

John

Get Updates on the Splunk Community!

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...