Hi @Satyapv, Hi, Here's another alternative. We'll use internal splunkd components to simulation a field named Transaction. To see event counts over [-300,0], [-600,0], and [-900,0] seconds: index=_internal sourcetype=splunkd component=* earliest=-15m latest=now
| rename component as Transaction
| addinfo ``` assumes a valid latest value ```
| stats
count(eval(_time>=info_max_time-300)) as "Last 5min Vol"
count(eval(_time>=info_max_time-600)) as "Last 10min Vol"
count as "Last 15min Vol"
by Transaction To see event counts over [-300,0], [-600,300), and [-900,600) seconds: index=_internal sourcetype=splunkd component=* earliest=-15m latest=now
| rename component as Transaction
| addinfo ``` assumes a valid latest value ```
| stats
count(eval(_time>=info_max_time-300)) as "Last 5min Vol"
count(eval(_time>=info_max_time-600 AND _time<info_max_time-300)) as "Last 10min Vol"
count(eval(_time<info_max_time-600)) as "Last 15min Vol"
by Transaction You can adjust earliest and latest as needed, but note that the last count will always be inclusive of earliest, i.e. the last 15 minutes for -15m. You adjust the count aggregates to disallow counting events more than 900 seconds (15 minutes) prior to latest: count(eval(_time>=info_max_time-900)) as "Last 15min Vol" or count(eval(_time>=info_max_time-900 AND _time<info_max_time-600)) as "Last 15min Vol"
... View more