I am trying to group events with same fields and get a count for every 5 minutes interval. I used the following search string:
index=example | rex field=_raw EXAMPLE(?.+) | spath input=json | stats count by field1 field2 fields3 field4 | bucket _time span=5m
Instead of returning count for every 5 minutes interval, it returned the total count of all time. Is "bucket _time span=..." not supposed to work with stats?
Hello! How do you know that your query is returning count every 5 minutes? I think you have to count by _time to know what happen
Try something like this :
index=example | rex field=_raw EXAMPLE(?.+) | spath input=json | bucket _time span=5m| stats count by field1 field2 fields3 field4 _time
Hello! How do you know that your query is returning count every 5 minutes? I think you have to count by _time to know what happen
Try something like this :
index=example | rex field=_raw EXAMPLE(?.+) | spath input=json | bucket _time span=5m| stats count by field1 field2 fields3 field4 _time
The "bucket" command needs to come before the "stats" command like this:
index=example | rex field=_raw EXAMPLE(?.+) | spath input=json | bucket _time span=5m | stats count by _time field1 field2 fields3 field4
The bucket command is for taking an existing field value and putting it into discrete sets... in the case of _time, it would alter events to be in 5 minute segments.
Note the timestamp in your results the results between index=example | head 10
and index=example | head 10 | bucket _time span=5m
As time is a field just like everything else, you can bucket first, and then use _time in your stats command like so:
index=example | rex field=_raw EXAMPLE(?.+) | spath input=json | bucket _time span=5m | stats count by _time field1 field2 fields3 field4
(Notice the change of order of commands and the additional by field). Using bucket after stats does nothing since after stats, _time is no longer is present on the results.
You may also be interested in timechart but that would depend as to what you're doing with each of these.