Splunk Search

Streamstats And Timechart

subtrakt
Contributor

Hi -
Trying to sort by highest URL count, limit to 12(prevent "other" in the time-chart) and then time-chart. Thanks!

This doesn't seem to give me the desired results:

... | streamstats count by URL | accum URL | sort count limit=12 | timechart count span=2m by URL

Logic:

  • stream the stat counts by url
  • accumilate the streamed URL stats
  • sort by count
  • limit the count to 12 so "other" is not displayed on the timechart
  • create timechart

Another thing worth mentioning when i remove 'accum URL' and replace sort with | where count > n | it works but is not an automatic solution... I guess with "sort" i have to worry about rows being created and if >10000 rows are created i will have truncated results. Is that accurate?

This is what i'm using currently and it seems to be working -

... | streamstats count by URL | where count > 10 | timechart count span=2m by URL

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Wouldn't this achieve the desired output without any streamstats shenanigans?

... | timechart limit=12 useother=f span=2m count by URL

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Wouldn't this achieve the desired output without any streamstats shenanigans?

... | timechart limit=12 useother=f span=2m count by URL

subtrakt
Contributor

Is stream stats counting by the search duration? If i choose 2 hours it will look for any urls counts > 10 over 2 hours? or is it looking at a smaller default bucket size if i do not specify it prior?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...