Splunk Search

How to write a search to identify periods with no events in historical data?

evelenke
Contributor

Hi, Splunkers!

I have log where some different events (event A, event B, event C...) are expected to be generated periodically .
Now I want to calculate number of appearances of each event per_hour and identify, what of events did not appear in this particular time chunks and create report.
Like this:

time                   event      count
2016-08-31 22:00;00    event_A    0
2016-08-31 22:00;00    event_B    1
2016-08-31 22:00;00    event_C    3
2016-08-31 23:00;00    event_A    2
...

What I've tried:
1. | bucket _time span=1h | stats count by event _time | sort event by _time
This do not return zero values of count (e.g. time: "2016-08-31 22:00:00" event: "event_A" count: 0)
2. chart or timechart span=1h count by event helps only to visually identify my zero points, but I need an inline table view,
3. stats latest(_time) by event | eval diff=now()-latest ... not an option as this is required for historical data.

Do I miss something? How can I get result alike presented above?

0 Karma
1 Solution

sundareshr
Legend

Try this

... | timechart span=1h cont=t count by event | untable _time event count

View solution in original post

0 Karma

sundareshr
Legend

Try this

... | timechart span=1h cont=t count by event | untable _time event count
0 Karma

evelenke
Contributor

This is it, thank you!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...