Splunk Search

timechart per minute by multiple fields

sahil237888
Path Finder

Hi,

I have two fields with different values and I want count on both basis. These are events and hosts occured in log files.

Example -

I have fields like host and event.
Host values are like A , B, C,D.
Events are like reboot , running, shutdown.

And the results should show like -

_time A:reboot A:shutdown B:reboot C:running
00:01 1 2 1 4
00:02 2 4 3 1
00:03 0 1 4 5
00:04 1 2 0 1

0 Karma

to4kawa
Ultra Champion

sample:

| makeresults 
| eval host="a;b", events="reboot;running;shutdown" 
| makemv delim=";" host 
| makemv delim=";" events 
| stats values(_time) as _time by host events
| stats sum(eval(events="reboot")) as reboot sum(eval(events="running")) as running sum(eval(events="shutdown")) as shutdown by _time host
| xyseries _time host reboot running shutdown sep="_"
| foreach *_* [ rename <<FIELD>> as <<MATCHSEG2>>_<<MATCHSEG1>>]

recommend:

your_search
| bin _time span=1min
| stats count(eval(events="reboot")) as reboot count(eval(events="running")) as running count(eval(events="shutdown")) as shutdown by _time host
| xyseries _time host reboot running shutdown sep="_"
| foreach *_* [ rename <<FIELD>> as <<MATCHSEG2>>:<<MATCHSEG1>>]

Hi, @sahil237888
@MuS 's way is simple and good.
However, there is a problem.
If there is no status in the search period, the status will not be displayed.
If you need to output 0 as a result of three statuses, use my query.

0 Karma

MuS
Legend

Hi sahil237888,

you need to create a new field that represent host and the events and use this in the timechart command, take a look at this run everywhere SPL:

| makeresults 
| eval host="a;b", events="reboot;running;shutdown" 
| makemv delim=";" host 
| makemv delim=";" events 
| mvexpand host 
| mvexpand events 
| eval joiner=host .":". events 
| timechart span=1min count by joiner

Hope this helps ...

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...