Splunk Search

Increase count by 1 for every 10 Minutes

denamza
New Member

Hi All,

index="XXX" |stats latest(_time) as last_seen,values(ID) as ID, count by IP_Add | eval Filter=if(count%2==0,"Even","Odd") | search Filter="Odd" |eval hours_since=(now()-last_seen) | convert timeformat="%d-%b-%y %H:%M" ctime(last_seen) | eval readable = tostring(hours_since, "duration") | sort - last_seen | rename readable as "Running for: Days+:HH:MM:SS", last_seen as "Started",IP_Add as "IP" | table ID IP Started "Running for: Days+:HH:MM:SS" count |

How do i increase count to +1 for every let's say 10 minutes that shows on duration until the stop event is received?

Thanks!!

0 Karma

alanden_splunk
Splunk Employee
Splunk Employee

To increase count by 1 from its original value, use a counter with streamstats on a bucket of 10m:

| bucket last_seen AS last_bucket span=10m | streamstats dc(last_bucket) AS counter | eval count=count+counter
0 Karma

niketn
Legend

You would need to explain more about your use case with sample data as to what start event and end event look like. Also can you not use end epoch time - start epoch time to get duration as seconds and then divide by 600 To convert it to 10 minutes?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...