Splunk Search

"bucket _time span=..." has no affect on search results

yuelu
Explorer

I am trying to group events with same fields and get a count for every 5 minutes interval. I used the following search string:
index=example | rex field=_raw EXAMPLE(?.+) | spath input=json | stats count by field1 field2 fields3 field4 | bucket _time span=5m
Instead of returning count for every 5 minutes interval, it returned the total count of all time. Is "bucket _time span=..." not supposed to work with stats?

Tags (3)
1 Solution

stephanefotso
Motivator

Hello! How do you know that your query is returning count every 5 minutes? I think you have to count by _time to know what happen

Try something like this :

   index=example | rex field=_raw EXAMPLE(?.+) | spath input=json | bucket _time span=5m| stats count by field1 field2 fields3 field4 _time
SGF

View solution in original post

stephanefotso
Motivator

Hello! How do you know that your query is returning count every 5 minutes? I think you have to count by _time to know what happen

Try something like this :

   index=example | rex field=_raw EXAMPLE(?.+) | spath input=json | bucket _time span=5m| stats count by field1 field2 fields3 field4 _time
SGF

woodcock
Esteemed Legend

The "bucket" command needs to come before the "stats" command like this:


index=example | rex field=_raw EXAMPLE(?.+) | spath input=json | bucket _time span=5m | stats count by _time field1 field2 fields3 field4

acharlieh
Influencer

The bucket command is for taking an existing field value and putting it into discrete sets... in the case of _time, it would alter events to be in 5 minute segments.

Note the timestamp in your results the results between index=example | head 10 and index=example | head 10 | bucket _time span=5m

As time is a field just like everything else, you can bucket first, and then use _time in your stats command like so:

index=example | rex field=_raw EXAMPLE(?.+) | spath input=json | bucket _time span=5m | stats count by _time field1 field2 fields3 field4

(Notice the change of order of commands and the additional by field). Using bucket after stats does nothing since after stats, _time is no longer is present on the results.

You may also be interested in timechart but that would depend as to what you're doing with each of these.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...