Splunk Search

Event sampling with specific event gaps for multiple hosts

AshimaE
Explorer

I have multiple hosts in my result table and there is no specific sampling interval for each. However it is sure that in every host there are events at every 15 minutes though there can be variable number/ time of other events in between. How do I select the 15 minutes events from every host separately since I have to take the stats of the fields for every host separately.

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

You can use this:

... | bin _time span=15m

This will round all events down to the nearest 15-minute boundary. Now you can do your other magic.

View solution in original post

0 Karma

woodcock
Esteemed Legend

You can use this:

... | bin _time span=15m

This will round all events down to the nearest 15-minute boundary. Now you can do your other magic.

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

If you want to average the samples in every 15m interval
...
| bin _time span=15m
| stats avg(Value) as Value by _time host

If you want the first event out of every 15 minute interval and you know there will always be one...
...
| bin _time as Time span=15m
| stats earliest(Value) as Value by Time host

0 Karma

rjthibod
Champion

Can you share some of your SPL query and/or raw data? I am having a difficult time understanding what exactly you mean.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...