topic How to categorize time into group? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-categorize-time-into-group/m-p/645619#M223531 <P>Hi Splunkers,</P> <P>I am looking for a query to categorize timestamp into Morning, Afternoon, Night. I'm using this to know how many items were seen for each category in a month</P> <P>0001-0800 = Morning<BR />0801-1600 = Afternoon<BR />1601-0000 = Night</P> <P>Example output:</P> <P>Date&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Time&nbsp;&nbsp;&nbsp;&nbsp; Category<BR />02-May-2023&nbsp;&nbsp;&nbsp; 1043&nbsp;&nbsp;&nbsp; Afternoon<BR />02-May-2023&nbsp;&nbsp;&nbsp; 1932 &nbsp;&nbsp; Night<BR />04-May-2023&nbsp;&nbsp;&nbsp; 0249 &nbsp;&nbsp; Morning<BR />04-May-2023&nbsp;&nbsp;&nbsp; 0717 &nbsp;&nbsp; Morning<BR />14-May-2023&nbsp;&nbsp;&nbsp; 2051&nbsp;&nbsp;&nbsp; Night<BR />20-May-2023&nbsp;&nbsp;&nbsp; 0534 &nbsp;&nbsp; Morning<BR /><BR />Thank you very much</P> Mon, 05 Jun 2023 14:26:53 GMT JimLucas 2023-06-05T14:26:53Z How to categorize time into group? https://community.splunk.com/t5/Splunk-Search/How-to-categorize-time-into-group/m-p/645619#M223531 <P>Hi Splunkers,</P> <P>I am looking for a query to categorize timestamp into Morning, Afternoon, Night. I'm using this to know how many items were seen for each category in a month</P> <P>0001-0800 = Morning<BR />0801-1600 = Afternoon<BR />1601-0000 = Night</P> <P>Example output:</P> <P>Date&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Time&nbsp;&nbsp;&nbsp;&nbsp; Category<BR />02-May-2023&nbsp;&nbsp;&nbsp; 1043&nbsp;&nbsp;&nbsp; Afternoon<BR />02-May-2023&nbsp;&nbsp;&nbsp; 1932 &nbsp;&nbsp; Night<BR />04-May-2023&nbsp;&nbsp;&nbsp; 0249 &nbsp;&nbsp; Morning<BR />04-May-2023&nbsp;&nbsp;&nbsp; 0717 &nbsp;&nbsp; Morning<BR />14-May-2023&nbsp;&nbsp;&nbsp; 2051&nbsp;&nbsp;&nbsp; Night<BR />20-May-2023&nbsp;&nbsp;&nbsp; 0534 &nbsp;&nbsp; Morning<BR /><BR />Thank you very much</P> Mon, 05 Jun 2023 14:26:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-categorize-time-into-group/m-p/645619#M223531 JimLucas 2023-06-05T14:26:53Z Re: Categorize Time into group https://community.splunk.com/t5/Splunk-Search/How-to-categorize-time-into-group/m-p/645620#M223532 <LI-CODE lang="markup">| bin _time span=8h aligntime=@d</LI-CODE> Sat, 03 Jun 2023 05:17:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-categorize-time-into-group/m-p/645620#M223532 ITWhisperer 2023-06-03T05:17:57Z