O'Reilly logo

Implementing Splunk - Second Edition by James D Miller, Vincent Bumgarner

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Calculating events per slice of time

There are a number of ways to calculate events per some period of time. All these techniques rely on rounding _time down to some period of time, and then grouping the results by the rounded buckets of _time.

Using timechart

The simplest approach to counting events over time is simply to use timechart, like this:

sourcetype=impl_splunk_gen network=prod
| timechart span=1m count

In the table view, we see the following:

Using timechart

Charts in Splunk do not attempt to show more points than the pixels present on the screen. The user is, instead, expected to change the number of points to graph, using the bins or span attributes. Calculating ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required