topic Re: Splunk Enterprise Security: How to write a search to create a time chart or a table with notable event times by hour? in Splunk Enterprise Security https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-How-to-write-a-search-to-create-a/m-p/283381#M2412 <P>'es_notable_events' works off an inputlookup that I don't think you can get data further back than the last 24 hours.</P> <P>Try This search it seems to work for me.</P> <PRE><CODE>`notable' | search NOT `suppression' | search (status="*") (owner="*") (security_domain="*") | timechart minspan=1h count by urgency </CODE></PRE> <P>The 'notable' macro works of the notable index so you should get the data your looking for.</P> Tue, 29 Sep 2020 12:26:30 GMT AnthonyTibaldi 2020-09-29T12:26:30Z Splunk Enterprise Security: How to write a search to create a time chart or a table with notable event times by hour? https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-How-to-write-a-search-to-create-a/m-p/283380#M2411 <P>Does anyone have a search to create either a timechart or a table with the notable event times by hour? I want to create a list of the busiest times our notables come in by urgency. I.E. 5 10 lows at 9:00, 11 lows at 10:00, 5 mediums at 9:00, 7 mediums at 10:00, etc. </P> <P>This search works, but only for the last 24 hours:</P> <PRE><CODE>| `es_notable_events` | search timeDiff_type=current | timechart minspan=1h sum(count) as count by urgency </CODE></PRE> <P>I'd like to do an average number of tickets per hour of the day going back at least 30 days. </P> Thu, 27 Oct 2016 17:46:32 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-How-to-write-a-search-to-create-a/m-p/283380#M2411 kmcaloon 2016-10-27T17:46:32Z Re: Splunk Enterprise Security: How to write a search to create a time chart or a table with notable event times by hour? https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-How-to-write-a-search-to-create-a/m-p/283381#M2412 <P>'es_notable_events' works off an inputlookup that I don't think you can get data further back than the last 24 hours.</P> <P>Try This search it seems to work for me.</P> <PRE><CODE>`notable' | search NOT `suppression' | search (status="*") (owner="*") (security_domain="*") | timechart minspan=1h count by urgency </CODE></PRE> <P>The 'notable' macro works of the notable index so you should get the data your looking for.</P> Tue, 29 Sep 2020 12:26:30 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-How-to-write-a-search-to-create-a/m-p/283381#M2412 AnthonyTibaldi 2020-09-29T12:26:30Z