Splunk Search

How do I sum by strftime day?

timmoammo
New Member

Hello,

A simple questions I think.......

I'm moving my _time by 6 hours and creating newTime then using strftime to look at the results.

I then want to sum GJ by day of the newTime/strftime and then find the max of this?

This is the part of the search that isn't working

eval newTime = relative_time(_time, "-6h")

| eval n=strftime(newTime , "%Y/%m/%d-%T")
| stats sum(GJ) as MaxDay BY n_day

Any help is appreciated

Tags (1)
0 Karma

lguinn2
Legend

Try this - just use n instead of n_day

eval newTime = relative_time(_time, "-6h")
...
| eval n=strftime(newTime , "%Y/%m/%d-%T") 
| stats sum(GJ) as MaxDay BY n

timmoammo
New Member

Thanks for response however this doesn't seem to work.

The bit I'm struggling with is summing by day in the adjusted strftime.

i.e. I want to sum the GJ by day (in STRFtime) and then get the max of this

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...