Splunk Search

How do I create a timechart with spans that aren't aligned to the start of a minute/hour/day etc?

lukemundy
New Member

I'm using timechat to count the number of events per minute in a single value display: search | timechart span=1m count

This works fine. However, each time span is aligned to the top of the minute, meaning that the single value is only ever accurate when the search is conducted at the top of the minute. I want my single value to display the total number of requests in the last minute from now and not the last whole minute.

For example, if the search is running at 12:15:39, the single value should show the count of events between 12:14:39 and 12:15:39, rather than the count from 12:14:00 to 12:15:00 (or, if using partial=true, 12:15:00 to 12:15:39)

Is timechart suitable for this or do I need to use another method?

0 Karma

woodcock
Esteemed Legend

You can add/remove any arbitrary time-segment like this:

Your Base Search Here
[| makeresults 
 | rename COMMENT AS "This expands the window by 1 minute on each side"
 | addinfo 
 | eval search = "earliest=" . (info_min_time - 60) . " latest=" . (info_max_time + 60)
 | table search]
| timechart count span=1m

DalJeanis
SplunkTrust
SplunkTrust

You can add/subtract an offset, run your timechart, then subtract/add it back.

Here's a run-anywhere example...

 index=_internal earliest=-610s 
| addinfo | eval delay=info_max_time % 60 | eval _time = _time - delay 
| timechart span=1m count  
| addinfo | eval delay=info_max_time % 60 | eval _time = _time + delay | fields - delay info*

Notes

1) timechart kills the calculated field, so you have to do it all over again, then delete the added fields as well.

2) You can use info_max_time or info_min_time, depending on whether you are more concerned about aligning the start of the period or the end of the period. They are functionally equivalent except for edge cases.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...