Splunk Search

How do I sum by strftime day?

timmoammo
New Member

Hello,

A simple questions I think.......

I'm moving my _time by 6 hours and creating newTime then using strftime to look at the results.

I then want to sum GJ by day of the newTime/strftime and then find the max of this?

This is the part of the search that isn't working

eval newTime = relative_time(_time, "-6h")

| eval n=strftime(newTime , "%Y/%m/%d-%T")
| stats sum(GJ) as MaxDay BY n_day

Any help is appreciated

Tags (1)
0 Karma

lguinn2
Legend

Try this - just use n instead of n_day

eval newTime = relative_time(_time, "-6h")
...
| eval n=strftime(newTime , "%Y/%m/%d-%T") 
| stats sum(GJ) as MaxDay BY n

timmoammo
New Member

Thanks for response however this doesn't seem to work.

The bit I'm struggling with is summing by day in the adjusted strftime.

i.e. I want to sum the GJ by day (in STRFtime) and then get the max of this

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...