Splunk Search

How to search the count of IDs processed for multiple response time ranges?

prashanthberam
Explorer

hi i have two fields: IDs and response time in seconds. so by using the response time, i need to break down events
0-1 sec how many IDs were processed (their count)
1-2 sec how many IDs were processed
.....
9-10 sec how many IDs were processed

can someone help me thanks.

0 Karma
1 Solution

prashanthberam
Explorer

Thanks for your answer i got it by using the ceil and floor commands...thank you so much for your answers..it looks like it will also work for my case

0 Karma

niketn
Legend

Seems like you need the following, IDs processed every second (which in-turn will require you to run the search for shorter duration) :
your base search ID=* | timechart span=1s count(ID) as "IDs Processed"

If this is not what you need please provide field names and examples.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...