topic Re: Timechart - span=30m show data in 15th and 45th min in Splunk Search

Timechart - span=30m show data in 15th and 45th min

askkawalkar — Tue, 18 Jun 2019 07:02:43 GMT

I am trying to create a timechart
base search ...
| timechart span=30m latest(COUNT) as COUNT by NAME

it is providing me events for field "_time" as : "12:00", "12:30", "01:00", "01:30" .. and so on..

I want field "_time" as : "12:15", "12:45", "01:15", "1:45" ... and so on...

Is there any solution to convert _time.

Thanks in advance.

Re: Timechart - span=30m show data in 15th and 45th min

VatsalJagani — Tue, 18 Jun 2019 12:21:24 GMT

Hello @askkawalkar,

This query worked for me. Instead of timechart use below list of evals, stat and chart to achieve your requirement.

<your query>
| bin _time span=15m 
| stats latest(COUNT) as COUNT by _time, NAME
| eval _time=_time/100 
| eval _time=if(_time%2==0,_time-9,_time) 
| eval _time=_time*100 
| chart last(COUNT) as COUNT over _time by NAME

Re: Timechart - span=30m show data in 15th and 45th min

VatsalJagani — Fri, 21 Jun 2019 07:14:37 GMT

@askkawalkar - Did you get chance to check answer?

Re: Timechart - span=30m show data in 15th and 45th min

adonio — Fri, 21 Jun 2019 13:03:51 GMT

here is another way of achieving your goal with the aligntime attribute:
read here:
https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchReference/Bin#Bin_options

run this search anywhere:

| gentimes start=-2 increment=1m
| eval _time = starttime 
| eval number = random()%200
| bin _time span=30m aligntime=@d+15m
| timechart max(number) as max_number

hope it helps

Re: Timechart - span=30m show data in 15th and 45th min

askkawalkar — Fri, 21 Jun 2019 14:36:46 GMT

Hi @VatsalJagani ,

Thanks for your quick help. This solution worked for me.

Below is the run anywhere query (@adonio: thanks for providing run anywhere search)

| gentimes start=-2 increment=30m
 | eval _time = starttime 
 | eval number = random()%200
| bin _time span=15m 
 | stats latest(number) as COUNT by _time
 | eval _time=_time/100 
 | eval _time=if(_time%2==0,_time-9,_time) 
 | eval _time=_time*100 
 | chart last(COUNT) as COUNT over _time

Regards,
Ankush

Re: Timechart - span=30m show data in 15th and 45th min

askkawalkar — Fri, 21 Jun 2019 14:42:27 GMT

Hi @adonio ,

Thanks for your help in search anywhere.

Thanks,
Ankush