Display count for multiple time increments

Question

I have log data that tracks the completion of jobs. I'd like to be able to track the completed jobs, but for 4 different increments: the last 5 minutes, last 30 minutes, last hour, and last 24 hours, and I'd like it to be displayed in a table, something like this.

JobType | 5mins  | 30mins | 60mins | 24hrs  
AA          2        30      100       150
BB          0        10       20        30

And the data resembles something like this:

<timestamp> JobType=AA status=Finished
<timestamp> JobType=BB status=Finished

I can do a count on status=Finished and dump that to a simpleResultsTable by JobType for the entire log file or for a single start/end period. But how would I send that to a simpleResultsTable for multiple increments?

Accepted Answer

1

You should be able to use eval and relative_time to sort this one out:

status=Finished 
      | stats sum(eval(if(_time > relative_time(now(), "-5m"),1,0))) as 5mins,  
              sum(eval(if(_time > relative_time(now(), "-30m"),1,0))) as 30mins,  
              sum(eval(if(_time > relative_time(now(), "-60m"),1,0))) as 60mins,  
              sum(eval(if(_time > relative_time(now(), "-24h"),1,0))) as 24hrs by JobType

Let me know if that works.

link

answered 20 Jul '11, 15:54

David
1.9k●9
accept rate: 45%

Yes that works. Thanks!

(20 Jul '11, 16:33) cejohnson

Excellent! I'm glad to hear that.

(22 Jul '11, 00:33) David

Display count for multiple time increments

Follow this question

Splunk Resources

Related questions