https://community.splunk.com/t5/Splunk-Search/How-to-put-working-hours-from-each-user-by-day-in-a-time-chart/m-p/361488#M106760 <P>My search so far:</P> <PRE><CODE>index=notimportant EventID=4624 [ inputlookup users.csv | fields TargetUserName ] | chart eval(latest(_time) - earliest(_time)) as total by TargetUserName | fieldformat total=strftime(total, "%H:%M") </CODE></PRE> <P>What I'm doing is:</P> <P>Get the earliest event from the result and the latest event from the result (the results are Microsoft login events). Subtracting the logout time from the login time so I get the working times.</P> <P>Problems: </P> <UL> <LI><P>I cannot display times in a time/timechart (when I remove the ":" characters the chart works).</P></LI> <LI><P>When I change the type from chart --&gt; timechart the entry's in the timechart are displayed by the long number notations (not human readable, I forgot the name of this notation).</P></LI> </UL> <P>All I want is the working hours from each user by day, thanks!</P> Thu, 10 Aug 2017 12:10:18 GMT rens78 2017-08-10T12:10:18Z https://community.splunk.com/t5/Splunk-Search/How-to-put-working-hours-from-each-user-by-day-in-a-time-chart/m-p/361488#M106760 <P>My search so far:</P> <PRE><CODE>index=notimportant EventID=4624 [ inputlookup users.csv | fields TargetUserName ] | chart eval(latest(_time) - earliest(_time)) as total by TargetUserName | fieldformat total=strftime(total, "%H:%M") </CODE></PRE> <P>What I'm doing is:</P> <P>Get the earliest event from the result and the latest event from the result (the results are Microsoft login events). Subtracting the logout time from the login time so I get the working times.</P> <P>Problems: </P> <UL> <LI><P>I cannot display times in a time/timechart (when I remove the ":" characters the chart works).</P></LI> <LI><P>When I change the type from chart --&gt; timechart the entry's in the timechart are displayed by the long number notations (not human readable, I forgot the name of this notation).</P></LI> </UL> <P>All I want is the working hours from each user by day, thanks!</P> Thu, 10 Aug 2017 12:10:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-put-working-hours-from-each-user-by-day-in-a-time-chart/m-p/361488#M106760 rens78 2017-08-10T12:10:18Z https://community.splunk.com/t5/Splunk-Search/How-to-put-working-hours-from-each-user-by-day-in-a-time-chart/m-p/361489#M106761 <P>Try this ...</P> <PRE><CODE>index=notimportant EventID=4624 [ inputlookup users.csv | fields TargetUserName ] | bin _time as myday span=1d | stats min(_time) as mintime max(_time) as maxtime by TargetUserName myday | eval TotalHours = round((maxtime-mintime)/3600,2) | rename mintime as _time | timechart span=1d sum(TotalHours) as TotalHours by TargetUserName </CODE></PRE> Thu, 10 Aug 2017 14:21:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-put-working-hours-from-each-user-by-day-in-a-time-chart/m-p/361489#M106761 DalJeanis 2017-08-10T14:21:05Z https://community.splunk.com/t5/Splunk-Search/How-to-put-working-hours-from-each-user-by-day-in-a-time-chart/m-p/361490#M106762 <P>Awsome!!!!</P> Mon, 14 Aug 2017 08:36:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-put-working-hours-from-each-user-by-day-in-a-time-chart/m-p/361490#M106762 rens78 2017-08-14T08:36:07Z