Splunk Search

How to count IDs that are in the range between current_time and end_time for each second?

diavolo
Path Finder

I want to count up IDs which are in the range between current_time and end_time for each second.
For example, as for the following data source table, count 1 during 13:17:44 - 13:18:17 only for id: 1cf789ef, then count 2 during 13:18:17 - 13:18:21 for id: 1cf789ef and 3c05282c. Then I want it to be line chart.
Data Source

Output should look like...
alt text

How do I achieve this?

0 Karma
1 Solution

lquinn
Contributor

If a line chart is the end goal, you could use concurrency to find the number of overlapping events, along with gentimes to create an event for every second. You will need to adjust the parameters of gentimes depending on the time you want your graph to show. This will not however list each individual id, only a count of the number of id's. Try the following search:

<your_current_search> | table id, current_time, end_time | eval starttime=strptime(current_time,"%Y/%m/%d %H:%M:%S") | eval endtime=strptime(end_time,"%Y/%m/%d %H:%M:%S") | eval duration = endtime-starttime | append [|gentimes start=01/21/2017:13:00:00 end=01/21/2017:15:00:00 increment=1s | eval type="gentimes" | eval duration=1] | concurrency start=starttime duration=duration | where type="gentimes" | eval concurrency=concurrency-1 | rename starttime AS _time | timechart span=1s max(concurrency) AS "Number of Id's"

View solution in original post

woodcock
Esteemed Legend

diavolo
Path Finder

Thank you! I didn't know concurrency command. Very useful!!

0 Karma

lquinn
Contributor

If a line chart is the end goal, you could use concurrency to find the number of overlapping events, along with gentimes to create an event for every second. You will need to adjust the parameters of gentimes depending on the time you want your graph to show. This will not however list each individual id, only a count of the number of id's. Try the following search:

<your_current_search> | table id, current_time, end_time | eval starttime=strptime(current_time,"%Y/%m/%d %H:%M:%S") | eval endtime=strptime(end_time,"%Y/%m/%d %H:%M:%S") | eval duration = endtime-starttime | append [|gentimes start=01/21/2017:13:00:00 end=01/21/2017:15:00:00 increment=1s | eval type="gentimes" | eval duration=1] | concurrency start=starttime duration=duration | where type="gentimes" | eval concurrency=concurrency-1 | rename starttime AS _time | timechart span=1s max(concurrency) AS "Number of Id's"

diavolo
Path Finder

Great!!! This is exactly what I wanted.
Thank you!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...