SPLUNK STATS HOW TO
SPLUNK STATS WINDOWS

For example, starting at Timestamp=1:00PM for a window size W=5 minutes, the windows would be [1:00PM - 1:05PM), [1:05PM - 1:10PM), [1:10PM - 1:15PM). The window does not include the right-most edge. At the start of each window, any aggregations are restarted. With the tumbling option, data in one window will not overlap with data in another window. Example in Canvas View: tumbling Windowing methodĪ tumbling window slices up time into segments based on the length of the provided window size. See the table for more details on the two windowing methods. If the size is larger than the slide, then the windowing method used is sliding. If the size and slide fields are equal to each other, then the windowing method is tumbling. Instead, the infers the windowing method based on the size and slide fields.

You do not need to specify this argument in the SPL2 View. Optional arguments window Syntax: sliding | tumbling Description: A windowing method. Example in Canvas View: 60 seconds aggregations Syntax: aggregations=collection> Description: An aggregation function to apply on your events. For a list of valid timescales, see the 'Timescales' section. Example in Canvas View: timestamp size Syntax: size= Description: The window length, in milliseconds, to group events. Example in Canvas View: body timestamp Syntax: timestamp=expression Description: The field name where your record's timestamps are located. Stats aggregations( field), Required arguments by Syntax: collection> Description: The field values by which to group events. Function Output collection> This function outputs the same collection of records but with a different schema S. In the View Configurations tab, you can check what the original fields are for the data coming in to the stats function in the left sidebar, edit the function's arguments in the UI form, and see the outputted fields for data coming out of the stats function in the right sidebar.įunction Input/Output Schema Function Input collection> This function takes in collections of records with schema R. View configurations for the stats function by highlighting the function in the UI and clicking View Configurations. This function accepts a variable number of arguments. For example, for a window size of 1 minute, make your window slide at least 10 seconds. Best practices are to limit window sizes to 24 hours or less and have a slide that is no smaller than 1/6th of your window size.

The events must be grouped by one or more fields. Īpplies one or more aggregation functions on a stream of events in a specified time window.

SPLUNK STATS HOW TO

This topic describes how to use the function in the.

Splunk stats