Splunk Search

Timechart or stats or lastTime

asarolkar
Builder

When I execute this search, I get all events from organization : Barclays that contains records for 2012.

index="log" | search orgName="org\\barclays" | search "*2012*"

However, i want to do two things:

i) graph the number of calls made into a report
ii) find the timestamp for the last event.

I want to be able to do both without using report builder.

Any pointers on how to proceed with this ?

0 Karma
1 Solution

Ayn
Legend

First of all, you don't need to split that up into multiple searches. Rather you'll get worse performance if you do that compared to if use one single search instead.

index="log" orgName="org\\barclays" "*2012*"

Regarding your questions, you need to clarify i) a bit more. How do you count the number of calls? Is that the same as the number of events? Also how do you want to graph it? Over time, split by host, ...

ii)

index="log" orgName="org\\barclays" "*2012*" | stats first(_time)

UPDATE: As for i):

index="log" orgName="org\\barclays" "*2012*" | timechart count by orgName

View solution in original post

asarolkar
Builder

Guys: i want to simply chart the events over time without using the Report builder. Any ideas on how to go about it ?

0 Karma

Ayn
Legend

First of all, you don't need to split that up into multiple searches. Rather you'll get worse performance if you do that compared to if use one single search instead.

index="log" orgName="org\\barclays" "*2012*"

Regarding your questions, you need to clarify i) a bit more. How do you count the number of calls? Is that the same as the number of events? Also how do you want to graph it? Over time, split by host, ...

ii)

index="log" orgName="org\\barclays" "*2012*" | stats first(_time)

UPDATE: As for i):

index="log" orgName="org\\barclays" "*2012*" | timechart count by orgName

Ayn
Legend

Updated my answer.

asarolkar
Builder

The number of calls IS the same as number of events.

I want to graph is by time and then orgName

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...