Splunk Search

How to reduce TimeChart count by minute if bins > x?

subtrakt
Contributor

Hi Everyone,

Would like to reduce bin count to 1 for each bin if total bins is greater than 10. (basically I want to flatline a timechart if a trend last longer than 10 minutes)

Here's what I came up with but it's not changing the counts. This will show the timecount in the legend but still can't get it to decrease real count to 1 if bins are > 10

Query:

| bin span=1m  _time | eventstats dc(_time) AS TIMECOUNT by host TYPE  | eval TYPE=host." ".TYPE." 

    | TIMECOUNT=".TIMECOUNT | timechart span=1m count(eval(if(TIMECOUNT>10,count=1,count))) by TYPE limit=0
Tags (3)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Give this a try

your base search
| bucket span=1m _time | stats count by _time host TYPE 
| eval TYPE=host." ".TYPE."  
| eventstats dc(_time) AS TIMECOUNT by TYPE 
| eval count=if(TIMECOUNT>10,1,count)
| timechart span=1m sum(count) by TYPE limit=0

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Give this a try

your base search
| bucket span=1m _time | stats count by _time host TYPE 
| eval TYPE=host." ".TYPE."  
| eventstats dc(_time) AS TIMECOUNT by TYPE 
| eval count=if(TIMECOUNT>10,1,count)
| timechart span=1m sum(count) by TYPE limit=0
0 Karma

subtrakt
Contributor

That works. Thanks!

0 Karma

subtrakt
Contributor

Added host to eventstats and looks like its working now and keeping the TYPE > 10 bins at 1, everything else normal count. Thanks again!

0 Karma

subtrakt
Contributor

Apologies.

Just realized it works but every other TYPE = 1 also. The stuff > 10 buckets should be 1 everything else should keep its original count.

0 Karma

ssadanala1
Contributor

can you elaborate your use case

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...