Splunk Search

stats and timechart count not returning count of events. instead uses last value in the first column

scc00
Contributor

I am trying to get a simple count of events, instead i am getting the value of the first column as the count. Below is the simple search I am running.

index=main sourcetype=proxy_log | eval MB_out=round(((bytes_out/(1024*1024)))) | timechart count(MB_out)

There are only 3 events, so I am expecting the count to give me 3. instead it picks the last number in the first column which is 0.. eg below

_time count(MB_out)
2018-06-18 19:00:00 804
2018-06-18 19:30:00 837
2018-06-18 20:00:00 833
2018-06-18 20:30:00 839
2018-06-18 21:00:00 798
2018-06-18 21:30:00 848
2018-06-18 22:00:00 850
2018-06-18 22:30:00 819
2018-06-18 23:00:00 850
2018-06-18 23:30:00 819
2018-06-19 00:00:00 642
2018-06-19 00:30:00 345
2018-06-19 01:00:00 280
2018-06-19 01:30:00 270
2018-06-19 02:00:00 116
2018-06-19 02:30:00 4
2018-06-19 03:00:00 0
2018-06-19 03:30:00 0
2018-06-19 04:00:00 0
2018-06-19 04:30:00 0

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi scc00,
at first, if you want to count events, you don't need to use eval command,

index=main sourcetype=proxy_log 
| timechart count

If instead you want the sum of bytes you have to use eval command but in timechart you have to use sum function,

index=main sourcetype=proxy_log 
| eval MB_out=round(bytes_out/1024/1024) 
| timechart sum(MB_out)

Anyway, are you sure that you have events with bytes_out in the period when you have 0?

Bye.
Giuseppe

0 Karma

scc00
Contributor

Yes i have done all of that. I still get the last value in the timechart count) series. This is why i opened this question..this shouldn't happen, it's a simple command.

0 Karma

Ayn
Legend

Please elaborate, what do you mean by that there are 3 events? Which first column are you referring to?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...