Splunk Search

Hourly breakdown of data with math operation

chablist
New Member

I have a log file that always has the same structure of:
time1,time2,groupNumber

eg:
355350224,338837556,2
1355350228,338837557,2
1355312572,338828143,2
1355350212,338837553,2
1355350216,338837554,2
1355350220,338837555,2
1355350224,338837556,2
1355310304,338827576,2

I want to group the times into buckets of a 1 hour span and then take the resulting count in each of those buckets and divide them by a number lets say 60.

So assume i have 10 items during the 12am-1am window on 12/12 and 5 items during the 1am-2am window on 12/12

This will give me a resulting table looking like:

Time | FunctionEvaluation
12/12 12am | .16667
12/12 1am | .08333

I was able to get close with:
source = Data _raw=",,4" | timechart span=1h count

but i couldn't perform a math operation

and with this i wasn't able to breakdown by time:
source = Data | rex field=_raw ".,.,(?\d+)" | top 20 groupNumber | sort groupNumber | eval reliability = (1 - (count/12960))*100 | fields groupNumber, reliability

Tags (1)
0 Karma

chablist
New Member

finally figured it out:
source = Data _raw=",,4" | timechart span=1h count | eval reliability = count/60

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...