I have tried using bin command but as
index=test| bin span=1w _time | chart count as total_count by _time, action
But this gives me event count over a span of 30days for every 7 days.
Please help me understand how to aggregate events in index by week and by month.
hello there,
try this out:
index = test
| bin _time span=1w as week
| bin span=1mon _time as month
| stats count as total_count by week month action
| eval week_human = strftime(week, "%Y-%U")
| eval month_human = strftime(month, "%Y-%B")
hope it helps
It may be painful to do this on the raw data if you need to do this all the time, over and over. If you do, this is the kind of thing where a Summary Index
is useful;
https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Configuresummaryindexes
If you aggregate daily, then it becomes trivial to mine it out by week or by month from your daily aggregation/summary.
hello there,
try this out:
index = test
| bin _time span=1w as week
| bin span=1mon _time as month
| stats count as total_count by week month action
| eval week_human = strftime(week, "%Y-%U")
| eval month_human = strftime(month, "%Y-%B")
hope it helps