topic How to create after hour report? in Getting Data In

How to create after hour report?

Johnsonbc — Tue, 20 Dec 2022 16:50:28 GMT

I am trying to create an after hour query with specific time frames 1. Mon 0000-0700 and 1900-2400, 2. Tue 0000-0700 and 1900-2400, 3. Wed 0000-0700 and 1900-2400, Thur 0000-0700 and 1900-2400, Fri 0000-0700 and 1900-2400, Sat 0000-2400, and Sun 0000-2400. I have my Cron Express set for 43 10***

| sort - _time

| eval user=lower(user)

|eval Day=strftime(_time,”%A”)

|eval Hour=strftime(_time,”%H”)

|eval Date=strftime(_time,”Y-%m-%d”)

| search Hour IN (19,20,21,22,23,24,0,1,2,3,4,5,6,7)

| table Date, Day, Hour, “User Account”

I like the way this is displayed but I cannot figure out how to combine this query with a weekend (FRI 1900-Mon 0700) query. Or will I have to have two different queries? Once completed this will make a good dashboard.

Re: How to create after hour report?

richgalloway — Tue, 20 Dec 2022 16:52:15 GMT

Use OR to test for weekend days or weekday hours.

Re: How to create after hour report?

Johnsonbc — Tue, 20 Dec 2022 16:59:07 GMT

That work but it is not capturing 24 hours on Sat & Sun (0000-2400). It is only doing my week day Hours IN

Re: How to create after hour report?

richgalloway — Tue, 20 Dec 2022 19:15:21 GMT

It appears to capture the right times for me.

Re: How to create after hour report?

Johnsonbc — Tue, 20 Dec 2022 19:28:37 GMT

It was not working for me so, I created a dashboard with (Mon-Fri) so far.

| sort - _time

| eval user=lower(user)

|eval Day=strftime(_time,”%A”)

|eval Hour=strftime(_time,”%H”)

|eval Date=strftime(_time,”Y-%m-%d”)

| search Day IN (Monday) Hour IN (0,1,2,3,4,5,6,19,20,21,22,23)

| stats sum(user)

This gives me the number of user that log on after hours Mon-Fri and can drill down if need to. Still working on the weekend hours.

Re: How to create after hour report?

Johnsonbc — Wed, 21 Dec 2022 11:52:37 GMT

I think the reason it was not working for me is because I am running a PIVOT. I was having issues running "Earliest & Latest" and other time & date commands.