Splunk Search

using bin command and span

jvmerilla
Path Finder

HI,

I have this query:

index="sample_data" sourcetype="management_sampledata.csv" | fields* | search Status!=Closed "Ticket Type"="*" Priority="*"
| rename "Reported Date" AS Reported_Date
| eval reported_date = strptime(Reported_Date, "%m/%d/%y %H:%M")
| eval date_today = now()
| eval duration = round((date_today-reported_date)/86400)
| bin duration span=30
| chart count as "Open Tickets" by "Support_ Assigned Group", duration

and this is what it shows:
alt text

My question is why it returns 180-210 and 210-240? Is it possible that there will be overlaps, like if there's a data with the value of 210, then it will be in both 180-210 and 210-240?

Also is there a way where I can my make it like 180-210, 211-240?

I hope someone can help me with this.

Thank you.

Tags (4)
0 Karma
1 Solution

mayurr98
Super Champion

Hey @jvmerilla

I have tested this query using test data. There are no overlaps. Your query is perfectly fine.
here the output shows 190-210 which actually means 190-209. So There is no overlap
Also if you have fix columns there you can sort of rename columns by writing | rename 190-210 as 190-209 ..

PFA supporting proofs that there are no overlaps. look for 0-20(total_count) and add all 0-19(count) you will get 457.
date_minute count sum(count)
0 5 5
1 6 11
2 2 13
3 24 37
4 6 43
5 9 52
6 68 120
7 3 123
8 1 124
9 13 137
10 26 163
11 57 220
12 21 241
13 37 278
14 32 310
15 77 387
16 24 411
17 18 429
18 15 444
19 13 457

I hope this helps.

alt text
alt text

View solution in original post

morethanyell
Builder

eto yung approach ko dito men
index="excercises" Status!=Closed
| eval rd = strptime(ReportedDate, "%m/%d/%Y %H:%M")
| eventstats max(rd) as MaxDate
| eval age = floor((MaxDate - rd) / 86400)
| bin age span=30
| chart count as "Open Tickets" by SupportAssignedGroup, age
| rename SupportAssignedGroup as "Support Assigned Group"

0 Karma

mayurr98
Super Champion

Hey @jvmerilla

I have tested this query using test data. There are no overlaps. Your query is perfectly fine.
here the output shows 190-210 which actually means 190-209. So There is no overlap
Also if you have fix columns there you can sort of rename columns by writing | rename 190-210 as 190-209 ..

PFA supporting proofs that there are no overlaps. look for 0-20(total_count) and add all 0-19(count) you will get 457.
date_minute count sum(count)
0 5 5
1 6 11
2 2 13
3 24 37
4 6 43
5 9 52
6 68 120
7 3 123
8 1 124
9 13 137
10 26 163
11 57 220
12 21 241
13 37 278
14 32 310
15 77 387
16 24 411
17 18 429
18 15 444
19 13 457

I hope this helps.

alt text
alt text

jvmerilla
Path Finder

Hi @mayurr98,

I'm sorry but I did not understand. How would I check if there's no overlap?

0 Karma

mayurr98
Super Champion

you can look at the count. They are matching. Even you can check this on your data. for 0-19 the count is 457.
so basically even though it is written 0-20 it is basically a sum of 0-19

0 Karma

jvmerilla
Path Finder

Hi @mayurr98,

It took me a while to figure out what you mean but I get it now. And I already check the data using stats count(eval), and you're right, there's no overlapping. The 180-210 were actually the sum of 180-209.

Thank you for your help. 🙂

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...