Splunk® Enterprise

Search Reference

Download manual as PDF

Download topic as PDF

Time functions

per_day(X)

Description

Returns the values of field X, or eval expression X, for each day.

Usage

  • You can use the per_day(X) function with the timechart command.

Basic examples

The following example returns the values for the field total for each day.

... | timechart per_day(total)


The following example returns the results of the eval expression eval(method="GET")) AS Views .

... | timechart per_day(eval(method="GET")) AS Views


Extended example

This example uses the sample dataset from the Search Tutorial but should work with any format of Apache Web access log. Download the data set from this topic in the Search Tutorial and follow the instructions to upload it to your Splunk deployment.

This search uses the per_day() function and eval expressions to determine how many times the web pages were viewed and how many times items were purchased. The results appear on the Statistics tab.

sourcetype=access_* | timechart per_day(eval(method="GET")) AS Views_day, per_day(eval(action="purchase")) AS Purchases

To determine the number of Views and Purchases for each hour, minute, or second you can add the other time functions to the search. For example:

sourcetype=access_* | timechart per_day(eval(method="GET")) AS Views_day, per_hour(eval(method="GET")) AS Views_hour, per_minute(eval(method="GET")) AS Views_minute, per_day(eval(action="purchase")) AS Purchases

This screen image shows the result of the search. There are five columns.  first column contains dates, based on the event timestamps. The next column shows the number of views for each day. The third column shows the number of views for each hour. The forth column shows the number of views for each minute. The last column shows the number of purchases for each day.


per_hour(X)

Description

Returns the values of field X, or eval expression X, for each hour.

Usage

  • You can use the per_hour(X) function with the timechart command.

Basic examples

The following example returns the values for the field total for each hour.

... | timechart per_hour(total)


The following example returns the the results of the eval expression eval(method="POST")) AS Views .

... | timechart per_hour(eval(method="POST")) AS Views


per_minute(X)

Description

Returns the values of field X, or eval expression X, for each minute.

Usage

  • You can use the per_minute(X) function with the timechart command.

Basic examples

The following example returns the values for the field total for each minute.

... | timechart per_minute(total)


The following example returns the the results of the eval expression eval(method="GET")) AS Views .

... | timechart per_minute(eval(method="GET")) AS Views


per_second(X)

Description

Returns the values of field X, or eval expression X, for each second.

Usage

  • You can use the per_second(X) function with the timechart command.

Basic examples

The following example returns the values for the field kb for each second.

... | timechart per_second(kb)

PREVIOUS
Multivalue stats and chart functions
  NEXT
Date and time format variables

This documentation applies to the following versions of Splunk® Enterprise: 6.6.0, 6.6.1, 6.6.2, 6.6.3, 7.0.0


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters