Splunk Search

How to create specific timerange fields to group stats?

Fleety
Loves-to-Learn Lots

Hello,

I have a collection of logs (same source type) but some of them have different or additional fields. In order to figure out when they appear, I'm trying to create a Query that shows me which fields are distinct after a specific time range.

Let's say I have 200 events from 13:00 to 14:00. Now I want to group by stats values(*) results by creating timerangefields:

 

| eval timerange1=(13:00 to 13:15), timerange2=(13:15 to 13:30)

 

so I can use 

 

|stats values(*) by timerange1, timerange2

 

 I was considering using date_hour, date_minute etc.. but I think there must be an easier way as I would need addititional commands. Also I don't know the right format as I get everytime "Type checking failed. '-' only takes numbers. So do you have any suggestions how I could solve this?

I'm thankful for any help

 

Kind regards

Alex

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Fleety,

see this approach to adapt to your need:

<your_search earliest=-h@h latest=@h
| eval minute=strftime(_time"%M")
| eval timerange=if(minute<=30,"timerange1","timerange2")
 |stats values(*) AS * by timerange

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...