Splunk Search

How to create specific timerange fields to group stats?

Fleety
Loves-to-Learn Lots

Hello,

I have a collection of logs (same source type) but some of them have different or additional fields. In order to figure out when they appear, I'm trying to create a Query that shows me which fields are distinct after a specific time range.

Let's say I have 200 events from 13:00 to 14:00. Now I want to group by stats values(*) results by creating timerangefields:

 

| eval timerange1=(13:00 to 13:15), timerange2=(13:15 to 13:30)

 

so I can use 

 

|stats values(*) by timerange1, timerange2

 

 I was considering using date_hour, date_minute etc.. but I think there must be an easier way as I would need addititional commands. Also I don't know the right format as I get everytime "Type checking failed. '-' only takes numbers. So do you have any suggestions how I could solve this?

I'm thankful for any help

 

Kind regards

Alex

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Fleety,

see this approach to adapt to your need:

<your_search earliest=-h@h latest=@h
| eval minute=strftime(_time"%M")
| eval timerange=if(minute<=30,"timerange1","timerange2")
 |stats values(*) AS * by timerange

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...