I feel like this should be a piece of cake with distinct count. I'd like to turn this into a more elegant search: searchterms | bucket _time span=1m | stats count by punct,_time | join [searchterms | stats count by punct| stats sum(count) by punct] It gets the count of each punct in a given minute along with the total count for that punct over the entire search range. ... View more

So I have two searched joined together that works great, Unfortunately the subsearch reaches the time limit even on fast mode especially since I need to run the search over 3 years. I'd like a way to get rid of the subsearch while keeping the end results the same. search_term1 nid="*" | dedup nid | search NOT hostname="*" | rex field=nid "(?<ip>.*)@(?<network>.*)" | stats count AS nid_count by network | join [search search_term1 nid="*" NOT hostname="*" | rex field=nid "(?<ip>.*)@(?<network>.*)" | stats count AS event_count by network] Let me know if you have questions or need any more information. ... View more

Hey all, So the following seems to be a problem correctly piping stats stuff. Right now mean and sum will always be the same: search terms | bucket _time span=1m | stats count by punct,_time | stats mean(count),sum(count) AS sum by punct,_time |search sum>100 What I want is to have a field that gives the mean count by punct over the entire search time, but when I use the code above it will give the mean by punct and _time which, since it only counts the same time and punct once, will always be the same as the sum. After this is fixed I intend to make the "|search" part check to see if sum is greater than the mean by a certain amount. UPDATE: I am trying to use a subsearch to solve my problem: search_terms | bucket _time span=1m | stats count by punct,_time | append [search index=auth| stats count by punct| stats sum(count) by punct] selfjoin However, as you might be able to tell this will only give the sum of the entire punct in the row with the last time stamp as opposed to all rows with that punct. ... View more

So the intent is to have a field that returns the time stamp of a large number of similar events (same punct field) if it meets a certain condition. For example let's say the number of events in a minute with a certain punct is more than 100. I would like to get both the punct and the time stamp as fields. What I have right now and what should be a good start is: search_terms | bucket _time span=1m | stats count by punct,_time | stats mean(count),count by punct |eval test=if(count>100,"True","False") All this will do however is see if the total number of events with that punct is greater than 100 not if the number of events in a single minute. I'll also need the sime stamp but that's not a problem after I get this first part working. ... View more

Ok I'm rewriting this question as it has become much simpler than before. All I need to do is have a way the get the length of the current time range I am searching over (as a variable I hope) so that I can use it in eval. What I have right now is: search term |bucket _time span=1m | stats count by _time,punct | eval occurred=if(count!=0,1,0)| stats sum(count) AS sum,sum(occurred) AS num_of_mins_occurred,mean(count) AS mean,stdev(count) AS standard_deviation by punct |eval hourly=if((num_of_mins_occurred/4)=1,"True","False") ... View more