Splunk Search

Stats into timechart

wormfishin
Engager

I'm running a query for a 1 hour window. I need to group events by a unique ID and categorize them based on another field. I can do this with the transaction and timechart command although its very slow.
transaction keepevicted=true UniqueID | timechart span="5m" limit=10 avg(duration) by myTypes

I'm trying to reproduce this output using stats but I need the data broken down into 5 minute intervals for each type of transactions. Here is what I have now that contains the final data I need. stats range(_time) as UniqueID_Durations first(_time) by myTypes UniqueID

I want to split this into a timechart using the first(_time) and have the time chart caclulate the average UniqueID_Duration for each myTypes.

I feel like it should be this, but it does not work.

stats range(_time) as UniqueID_Duration first(_time) by myTypes UniqueID | timechart span=5m avg(UniqueID_Duration) by myTypes.

Any suggestions?

Tags (2)
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi wormfishin,

the timechart command uses _time of your event which is not available anymore after your stats. You could try something like this :

stats range(_time) as UniqueID_Duration first(_time) as myTime by myTypes UniqueID | chart span=5m avg(UniqueID_Duration) over myTime by myTypes

this is un-tested, but should work....

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi wormfishin,

the timechart command uses _time of your event which is not available anymore after your stats. You could try something like this :

stats range(_time) as UniqueID_Duration first(_time) as myTime by myTypes UniqueID | chart span=5m avg(UniqueID_Duration) over myTime by myTypes

this is un-tested, but should work....

cheers, MuS

wormfishin
Engager

eventstats actually worked better as it displayed the time in string format instead of epoch. Thanks, that was exactly what I needed.

gordo32
Communicator

agreed. I had a similar issue also resolved by eventstats

0 Karma

MuS
SplunkTrust
SplunkTrust

or simply use eventstats instead of stats and _time will stay in your results 😉

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...