Splunk Search

timechart of a sliding window count

pr0n
Explorer

I need a timechart that counts the number of distinct fieldx where that fieldx has more than x events in that span/bin.

I hope that makes sense, so sudocode would be something like

index=blah | stats count by fieldx as blah | where blah>5 |timechart span=1hr count distinct by fieldx  

That search obviously doesn't work, I'm not sure how to structure it to get what I want.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The pseudo-code fails because the stats command eliminated the _time field needed by timechart. Try this alternative:

index = blah | bin span=1h _time | stats count by _time fieldx | where count > 5 | timechart span=1h max(count) by fieldx
---
If this reply helps you, Karma would be appreciated.

View solution in original post

pr0n
Explorer

I was able to do this at seems to work correctly

index=asdf fieldx=* | bucket _time span=day  | stats  count by fieldx _time  | where count>2  | timechart distinct_count(fieldx)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The pseudo-code fails because the stats command eliminated the _time field needed by timechart. Try this alternative:

index = blah | bin span=1h _time | stats count by _time fieldx | where count > 5 | timechart span=1h max(count) by fieldx
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...