splunk - 在排序列表中分组数据

Question

在 splunk 中，我想在排序后按顺序对数据进行分组。

示例事件

Time: 1:00 server: A .....
Time: 1:01 server: A ......
Time: 1:02 server: B ......
Time: 1:03 server: A ......
Time: 1:04 server: A ......
Time: 1:05 server: C ......
Time: 1:06 server: A ......

我想看看

Server: A Events: 2
Server: B Events: 1
Server: A Events: 2
Server: C Events: 1
Server: A Events: 1

如果我也能获得每组的开始和结束时间，则可以加分。

标签： splunksplunk-query

Answer 1

尝试这样的事情：

index=ndx sourcetype=srctp server=* 
| stats min(_time) as First max(_time) as Last count as Events by server
| rename server as Server
| eval First=strftime(First,"%c"), Last=strftime(Last,"%c")
| table First Last Events Server

应该给你一个如下表：

First    | Last     | Events | Server
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
<time>   | <time>   | 7      | serverA

ETC