topic Time value shenanigans in Reporting

Time value shenanigans

elloyd4 — Wed, 21 Apr 2021 20:18:00 GMT

When I run this filter, I want splunk to give me a count per day based on the Month, day, and year of value sys_created_on instead of any ticket that may have been touched that day, but created on another day. What am I doing wrong!? I'm teaching myself and have at least made it this far.

I just want to get a count per day for the sys_created_on value. I tell it to give me per day values in the time picker and it give me incidents that were not created on that day.

SEARCH | dedup dv_number | table sys_created_on dv_number dv_u_username_id assignment_group_name dv_assigned_to dv_u_workstation_ci dv_cmdb_ci dv_u_location_1 description dv_close_notes u_last_3_worknotes dv_close_notes | rename sys_created_on AS "Created On", dv_number AS "Incident Number", dv_u_username_id AS "Username", assignment_group_name AS "Assignment Group", dv_assigned_to AS "Assigned to", dv_u_workstation_ci AS "Workstation ID", dv_cmdb_ci AS "CI" dv_u_location_1 AS "Location", description AS "Description", dv_close_notes AS "Closing Notes", u_last_3_worknotes AS "Last 3 Work Notes", dv_close_notes AS "Closing Notes" | sort by "Incident Number" desc

Re: Time value shenanigans

richgalloway — Wed, 21 Apr 2021 20:33:12 GMT

The time picker looks only at the _time field, not sys_created_on or any other. Any filtering on other time fields has to be done manually. If sys_created_on is in epoch (integer) form then this may help.

SEARCH | dedup dv_number | addinfo | where (sys_created_on >= info_min_time AND sys_created_on <= info_max_time | table sys_created_on dv_number dv_u_username_id assignment_group_name dv_assigned_to dv_u_workstation_ci dv_cmdb_ci dv_u_location_1 description dv_close_notes u_last_3_worknotes dv_close_notes | rename sys_created_on AS "Created On", dv_number AS "Incident Number", dv_u_username_id AS "Username", assignment_group_name AS "Assignment Group", dv_assigned_to AS "Assigned to", dv_u_workstation_ci AS "Workstation ID", dv_cmdb_ci AS "CI" dv_u_location_1 AS "Location", description AS "Description", dv_close_notes AS "Closing Notes", u_last_3_worknotes AS "Last 3 Work Notes", dv_close_notes AS "Closing Notes" | sort by "Incident Number" desc

If sys_created_on is a text field ("04/21/2021", for example) then it must be converted to an integer using the strptime function. That's left as a exercise for the reader.