Splunk Search

How to show data in a range grouped by specified time period?

DataOrg
Builder

i have below data. i want to represent in a range to group date for 5 days and i want date field to represent(16-08-16 - 16-08-30) count. pls help

    date        count
    16-08-26    14
    16-08-27    4
    16-08-28    14
    16-08-29    30
    16-08-30    34
    16-08-31    30
    16-09-01    6
    16-09-02    4
0 Karma
1 Solution

cmerriman
Super Champion

not knowing if you want 5 or 15 days yet, i have written this:
| eval earliest=relative_time(_time,"@mon-16d@d") |eval latest=relative_time(earliest,"+15d@d")|eval time=strftime(earliest,"%y-%m-%d")+" - "+strftime(latest,"%y-%m-%d")
and you can use time as the field to bucket by. you can adjust the values in the relative_time evals to meet your needs, if you really want only 5 days. these will bring you "17-08-16 - 17-08-31" for example.

View solution in original post

cmerriman
Super Champion

not knowing if you want 5 or 15 days yet, i have written this:
| eval earliest=relative_time(_time,"@mon-16d@d") |eval latest=relative_time(earliest,"+15d@d")|eval time=strftime(earliest,"%y-%m-%d")+" - "+strftime(latest,"%y-%m-%d")
and you can use time as the field to bucket by. you can adjust the values in the relative_time evals to meet your needs, if you really want only 5 days. these will bring you "17-08-16 - 17-08-31" for example.

DataOrg
Builder

Thanks. worked perfectly !

0 Karma

cmerriman
Super Champion

Awesome, i'm glad, just make sure to spot check that the counts all match! I'm sure you already did, but i just like to double check when doing aggregates!

0 Karma

cmerriman
Super Champion

do you mean 16-08-26 - 16-08-30 for a 5 day span or 16-08-16 - 16-08-30 for a 15 day span?

0 Karma

DataOrg
Builder

5 days span

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...