Splunk Search

what is the use of below query?

itsahmedshaikh1
Observer

index=botsv1 sourcetype="stream:http" | timechart max(date_year)

Labels (1)
Tags (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

To tell you the maximum value of the year value of an event over time.

As to whether this provides useful information, that's another story...

 

0 Karma
Get Updates on the Splunk Community!

Introducing New Splunkbase Governance!

Splunk apps are essential for maximizing the value of your Splunk Experience. Whether you’re using the default ...

Splunk Edge Processor | Popular Use Cases to Get Started with Edge Processor

Splunk Edge Processor offers more efficient, flexible data transformation – helping you reduce noise, control ...

3 Ways to Make OpenTelemetry Even Better

My role as an Observability Specialist at Splunk provides me with the opportunity to work with customers of ...