How do you search results produced from a timechart...by command?

Question

I have a query similar to below:

... | timechart span=30s count by host

resulting in output that looks like:

_time hosta hostb 3/12/12 15:10:00 6 0 3/12/12 15:10:30 10 5

From this output I'm only interested in '0' values and would like to report host and time values for those instances. I'm unable to craft a query to get a handle on values in this timechart command. Is there some way to address the count and host values in a subsequent search?

Accepted Answer

3

Ok , the untable command after timechart seems to produce the desired output

... | timechart span="30s" count by  host | untable _time host count | where count=0

link

answered 13 Mar '12, 19:47

Damien Dalli...
4.5k●2●3●13
accept rate: 23%

Nice. That does it! Thanks for help.

(13 Mar '12, 22:50) saltmills

Great! Happy Splunking.

(13 Mar '12, 23:09) Damien Dalli...

Answer 2

1

Try something like :

... | bucket _time span="30s"| stats count by host,_time | where count=0

link

answered 12 Mar '12, 19:45

Damien Dalli...
4.5k●2●3●13
accept rate: 23%

Thanks for response.

I'm actually using bucket command earlier in the query. However, it will not report a _time value for which no matching events occur, and no count=0 match will ever appear in your final results. By having the timechart command I can at least get count=0 instances appearing in the results along with associated _time and host, but the question is how do I isolate them?

(12 Mar '12, 21:07) saltmills

How do you search results produced from a timechart...by command?

Follow this question

Splunk Resources

Related questions