Splunk Search

How to display the stats count for multiple field values on a dashboard panel where the count is greater than 2 within 1 minute?

msackett
New Member

I have multiple fields with different values (error messages) from the same log. I am trying to get a count per field, per value. I want this to be displayed if count is >2 in a set time period(1m) in a panel of my dashboard.

index=? Field1=500 OR Field2="Server Error*" OR Field2="TIMEOUT*" OR Field3="authorize" |stats count by Field, Field1, Field2, Field3, Field4, Field5, Field6, |where count>2 

Can anyone help... Thanks

0 Karma
1 Solution

Richfez
SplunkTrust
SplunkTrust

I am presuming that you want these events divided into precise 1 minute chunks, regardless of the overall timeframe you've picked for your dashboard, and that you then want the "where" to only include them if for that one minute chunk of time had a count greater than 2. If that's right, then I think you are almost there.

Try add the "bin" command to your search before the stats, then adding your new time-span value to the by clause of your stats, like ...

index=? Field1=500 OR Field2="Server Error*" OR Field2="TIMEOUT*" OR Field3="authorize" 
| bin _time span=1m as minute 
| stats count by Field, Field1, Field2, Field3, Field4, Field5, Field6, minute
| where count>2

Give that a shot and see where it gets you.

A couple of notes:
1) If you don't want to see "minute" you can always remove it with ... | fields - minute ... once you are done with it (after stats).
2) This may only work for non-insane time-frames. If your dashboard is set to do a 6 month period, I'm not sure you can do a 1m bin there, at least not quickly. 🙂

View solution in original post

Richfez
SplunkTrust
SplunkTrust

I am presuming that you want these events divided into precise 1 minute chunks, regardless of the overall timeframe you've picked for your dashboard, and that you then want the "where" to only include them if for that one minute chunk of time had a count greater than 2. If that's right, then I think you are almost there.

Try add the "bin" command to your search before the stats, then adding your new time-span value to the by clause of your stats, like ...

index=? Field1=500 OR Field2="Server Error*" OR Field2="TIMEOUT*" OR Field3="authorize" 
| bin _time span=1m as minute 
| stats count by Field, Field1, Field2, Field3, Field4, Field5, Field6, minute
| where count>2

Give that a shot and see where it gets you.

A couple of notes:
1) If you don't want to see "minute" you can always remove it with ... | fields - minute ... once you are done with it (after stats).
2) This may only work for non-insane time-frames. If your dashboard is set to do a 6 month period, I'm not sure you can do a 1m bin there, at least not quickly. 🙂

msackett
New Member

Thank you. That worked..

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...