I have the following Splunk table data from a Splunk query output.

Source        RequestTime
SourceX     10/07/2020 04:03 AM  
SourceX     10/07/2020 07:15 AM 
SourceX     10/07/2020 11:19 AM
SourceY     10/07/2020 09:13 AM
SourceY     10/07/2020 11:09 AM
SourceY     10/07/2020 03:29 PM 
SourceY     10/07/2020 07:08 PM 
SourceZ     10/07/2020 09:43 AM 
SourceZ     10/07/2020 01:44 PM
SourceZ     10/07/2020 07:08 PM
SourceZ     10/07/2020 08:09 PM

Please help me to get the output as below table format.

Source    SourceCount     StartTime              EndTime
SourceX      3         10/07/2020 04:03 AM    10/07/2020 11:19 AM 
SourceY      4         10/07/2020 09:13 AM    10/07/2020 07:08 PM 
SourceZ      4         10/07/2020 09:43 AM    10/07/2020 08:09 PM
1

There are 1 answers

1
RichG On

The stats command can do that.

... | stats count as SourceCount, min(RequestTime) as StartTime, max(RequestTime) as EndTime by Source