topic Re: Splunk Timechart in Dashboards & Visualizations

Splunk Timechart- How get data for last 7 days for a particular time range?

onthakur — Fri, 27 May 2022 15:05:36 GMT

Hello,

I am looking for the timechart option where I can get data for last 7 days for a particular time range.

Ex :- if I select time range as 01:00:00 to 02:00:00 AM then should show data for last 7 days for the same time range.

Date/Time range	Count
2022-05-27 01:00:00 02:00:00	A
2022-05-26 01:00:00 02:00:00	B
2022-05-25 01:00:00 02:00:00	C
2022-05-24 01:00:00 02:00:00	D
2022-05-23 01:00:00 02:00:00	E
2022-05-22 01:00:00 02:00:00	F
2022-05-21 01:00:00 02:00:00	G

Thanks

Re: Splunk Timechart

gcusello — Fri, 27 May 2022 12:21:05 GMT

Hi @onthakur,

if you have the "date_hour" field you can use the following search:

index=your_index time_hour=1 earliest=-7d latest=now | timechart span=1d count

If yu haven't the above field you have to extract it:

index=your_index earliest=-7d latest=now | eval time_hour=strftime(_time,"%H") | where time_hour=1 | timechart span=1d count

Ciao.

Giuseppe

Re: Splunk Timechart

PickleRick — Fri, 27 May 2022 13:36:58 GMT

Don't use the time_hour fields! At least unless you understand how it works.

https://docs.splunk.com/Documentation/Splunk/8.2.6/Knowledge/Usedefaultfields

About the date_* fields:

"These are fields that provide additional searchable granularity to event timestamps.

Note: Only events that have timestamp information in them as generated by their respective systems will have date_* fields. If an event has a date_* field, it represents the value of time/date directly from the event itself. If you have specified any timezone conversions or changed the value of the time/date at indexing or input time (for example, by setting the timestamp to be the time at index or input time), these fields will not represent that."

So if have some form of timezone inconsistency between the raw timestamp data in the event and the timezone you're working with, you will have wrong results when working on those date_* results.