Hey.
I'm quite new with Splunk and learning for the moment. I need to show a table with " Time id count percentage "
For the last 15 days, I need to know the count of backend calls per id for each day.
I already extracted the Ids from a json file and now just need to show them as the way I described.
I'm trying some things I only have this search:
index=ips_api earliest=-15d updatesearch | rex field=summary "(?\{.*)" | spath input=json_data |timechart span=1d count by asset_data{}.id
but it doesn't show me what I want. It just shows a table with field time and the name of each asset id in other field with the counts of each search on backend like this:
time id12345 1269785 id9874
4/11 85 29 5
4/12 67 35 7
Try something like this
index=ips_api earliest=-15d updatesearch | rex field=summary "(?\{.*)" | spath input=json_data | bucket _time span=1d | stats count by _time asset_data{}.id | rename asset_data{}.id as id | eventstats sum(count) as total by _time | eval percentage=round(count*100/total,2)
| table _time id count percentage
Try something like this
index=ips_api earliest=-15d updatesearch | rex field=summary "(?\{.*)" | spath input=json_data | bucket _time span=1d | stats count by _time asset_data{}.id | rename asset_data{}.id as id | eventstats sum(count) as total by _time | eval percentage=round(count*100/total,2)
| table _time id count percentage
I missunderstood the question. Didn't have to put 15 rows for the 15 last days, Just look up in the logs of the last 15 days and extract that information. So final query (With your help somesoni2) is
index=updtr_api earliest=-15d updatesearch | rex field=summary "(?\{.*)" | spath input=json_data |stats count by asset_data{}.id | rename asset_data{}.id as id|eventstats sum(count) as total| eval percentage=round(count*100/total) |table id count percentage
thank you!
It'd help if you provided some sample data along with a sketch of what your results table should look like.