timetrend
Use the timetrend operator to perform aggregations over timespans.
Syntax
|timetrend [columnname=<field>] <aggr_func> [as new_field] [, <aggr_func> [as new_field], ...] [by <field>, ...] [span=interval]
columnname=<field>
|
Optional. Specify a new time column other than event_time (default) for aggregation. |
<aggr_func>
|
Statistics functions: avg, count, count(distinct <field>), max, min, sum |
span= [<integer>][s,h,m,d,w,mon,y]
|
Multiple units are not allowed for week, month, or year. In other words, specify 1 for the integer place when specifying week, month, or year. |
Usage
The timetrend operator can be used with time series visualizations to show trends.
Note: After you issue a search with timetrend, the value for span may be recalculated and rationalized to create meaningful buckets given the configured time range.
Examples
Example 1: Count events aggregated by month.
|timetrend count span=1monExample 2: Count events by source type with a ten-minute time span.
|timetrend count by sourcetype span=10mExample 3: Count events using a custom timestamp field for aggregation.
|timetrend columnname=timestamp count by sourcetypeExample 4: Buckets OCSF events into two hour intervals, counts events per bucket, and sorts chronologically.
ocsf |timetrend count span = 2h | sort event_time asc