https://community.splunk.com/t5/Splunk-Search/status-of-held-Data-has-to-complete-with-in-the-day-itself/m-p/686908#M234279 <P>"<SPAN>when the status is H and it has to complete within the day itself." - how is this determined from the data?</SPAN></P> Wed, 08 May 2024 17:08:00 GMT ITWhisperer 2024-05-08T17:08:00Z https://community.splunk.com/t5/Splunk-Search/status-of-held-Data-has-to-complete-with-in-the-day-itself/m-p/686907#M234278 <P>HI Team,<BR /><BR />when the status is H and it has to complete within the day itself.<BR />expected output for below sample data is count 2 completed overall within the day.<BR /><BR />Thanks in Advance!<BR /><BR />Sample output below:</P><TABLE width="1083"><TBODY><TR><TD width="198.887px" height="24px">_time</TD><TD width="103.912px" height="24px">OVERAL</TD><TD width="102.963px" height="24px">DT</TD><TD width="100.875px" height="24px">NUM</TD><TD width="63.95px" height="24px">STAT</TD><TD width="63.9375px" height="24px">FM</TD><TD width="63.9625px" height="24px">WLM</TD><TD width="63.9375px" height="24px">CS</TD><TD width="63.9375px" height="24px">OB</TD><TD width="63.9375px" height="24px">EM</TD><TD width="63.9375px" height="24px">RC</TD><TD width="63.9375px" height="24px">ER</TD><TD width="64.025px" height="24px">ST</TD></TR><TR><TD width="198.887px" height="46px">2024-03-07T01:50:00.000-05:00</TD><TD width="103.912px" height="46px">X</TD><TD width="102.963px" height="46px">20240307</TD><TD width="100.875px" height="46px">5</TD><TD width="63.95px" height="46px">C</TD><TD width="63.9375px" height="46px">C</TD><TD width="63.9625px" height="46px">C</TD><TD width="63.9375px" height="46px"><FONT face="arial black,avant garde">H</FONT></TD><TD width="63.9375px" height="46px">X</TD><TD width="63.9375px" height="46px">X</TD><TD width="63.9375px" height="46px">X</TD><TD width="63.9375px" height="46px">X</TD><TD width="64.025px" height="46px">X</TD></TR><TR><TD width="198.887px" height="46px">2024-03-07T03:30:10.000-05:00</TD><TD width="103.912px" height="46px">X</TD><TD width="102.963px" height="46px">20240307</TD><TD width="100.875px" height="46px">5</TD><TD width="63.95px" height="46px">C</TD><TD width="63.9375px" height="46px">C</TD><TD width="63.9625px" height="46px">C</TD><TD width="63.9375px" height="46px">P</TD><TD width="63.9375px" height="46px">X</TD><TD width="63.9375px" height="46px">X</TD><TD width="63.9375px" height="46px">X</TD><TD width="63.9375px" height="46px">X</TD><TD width="64.025px" height="46px">X</TD></TR><TR><TD width="198.887px" height="46px">2024-03-07T03:40:07.000-05:00</TD><TD width="103.912px" height="46px">X</TD><TD width="102.963px" height="46px">20240307</TD><TD width="100.875px" height="46px">5</TD><TD width="63.95px" height="46px">C</TD><TD width="63.9375px" height="46px">C</TD><TD width="63.9625px" height="46px"><FONT face="arial black,avant garde">H</FONT></TD><TD width="63.9375px" height="46px">H</TD><TD width="63.9375px" height="46px">H</TD><TD width="63.9375px" height="46px">H</TD><TD width="63.9375px" height="46px">H</TD><TD width="63.9375px" height="46px">H</TD><TD width="64.025px" height="46px">H</TD></TR><TR><TD width="198.887px" height="46px">2024-03-07T06:10:14.000-05:00</TD><TD width="103.912px" height="46px">X</TD><TD width="102.963px" height="46px">20240307</TD><TD width="100.875px" height="46px">5</TD><TD width="63.95px" height="46px">C</TD><TD width="63.9375px" height="46px">C</TD><TD width="63.9625px" height="46px">C</TD><TD width="63.9375px" height="46px">I</TD><TD width="63.9375px" height="46px">X</TD><TD width="63.9375px" height="46px">X</TD><TD width="63.9375px" height="46px">X</TD><TD width="63.9375px" height="46px">X</TD><TD width="64.025px" height="46px">X</TD></TR><TR><TD width="198.887px" height="46px">2024-03-07T07:10:16.000-05:00</TD><TD width="103.912px" height="46px">X</TD><TD width="102.963px" height="46px">20240307</TD><TD width="100.875px" height="46px">5</TD><TD width="63.95px" height="46px">C</TD><TD width="63.9375px" height="46px">C</TD><TD width="63.9625px" height="46px">C</TD><TD width="63.9375px" height="46px"><FONT face="arial black,avant garde">H</FONT></TD><TD width="63.9375px" height="46px">X</TD><TD width="63.9375px" height="46px">X</TD><TD width="63.9375px" height="46px">X</TD><TD width="63.9375px" height="46px">X</TD><TD width="64.025px" height="46px">X</TD></TR><TR><TD width="198.887px" height="46px">2024-03-07T07:30:17.000-05:00</TD><TD width="103.912px" height="46px">X</TD><TD width="102.963px" height="46px">20240307</TD><TD width="100.875px" height="46px">5</TD><TD width="63.95px" height="46px">C</TD><TD width="63.9375px" height="46px">C</TD><TD width="63.9625px" height="46px">C</TD><TD width="63.9375px" height="46px">I</TD><TD width="63.9375px" height="46px">X</TD><TD width="63.9375px" height="46px">X</TD><TD width="63.9375px" height="46px">X</TD><TD width="63.9375px" height="46px">X</TD><TD width="64.025px" height="46px">X</TD></TR><TR><TD width="198.887px" height="46px">2024-03-07T08:20:18.000-05:00</TD><TD width="103.912px" height="46px">X</TD><TD width="102.963px" height="46px">20240307</TD><TD width="100.875px" height="46px">5</TD><TD width="63.95px" height="46px">C</TD><TD width="63.9375px" height="46px">C</TD><TD width="63.9625px" height="46px">C</TD><TD width="63.9375px" height="46px">C</TD><TD width="63.9375px" height="46px">I</TD><TD width="63.9375px" height="46px">C</TD><TD width="63.9375px" height="46px">I</TD><TD width="63.9375px" height="46px">C</TD><TD width="64.025px" height="46px">C</TD></TR><TR><TD width="198.887px" height="46px">2024-03-07T08:30:22.000-05:00</TD><TD width="103.912px" height="46px"><FONT face="arial black,avant garde">C</FONT></TD><TD width="102.963px" height="46px">20240307</TD><TD width="100.875px" height="46px">5</TD><TD width="63.95px" height="46px">C</TD><TD width="63.9375px" height="46px">C</TD><TD width="63.9625px" height="46px">C</TD><TD width="63.9375px" height="46px">C</TD><TD width="63.9375px" height="46px">C</TD><TD width="63.9375px" height="46px">C</TD><TD width="63.9375px" height="46px">C</TD><TD width="63.9375px" height="46px">C</TD><TD width="64.025px" height="46px">C</TD></TR><TR><TD width="198.887px" height="46px">2024-03-07T02:20:01.000-05:00</TD><TD width="103.912px" height="46px">X</TD><TD width="102.963px" height="46px">20240307</TD><TD width="100.875px" height="46px">5</TD><TD width="63.95px" height="46px">C</TD><TD width="63.9375px" height="46px">C</TD><TD width="63.9625px" height="46px">C</TD><TD width="63.9375px" height="46px">X</TD><TD width="63.9375px" height="46px">X</TD><TD width="63.9375px" height="46px">X</TD><TD width="63.9375px" height="46px">X</TD><TD width="63.9375px" height="46px">X</TD><TD width="64.025px" height="46px">X</TD></TR><TR><TD width="198.887px" height="46px">2024-03-07T03:30:10.000-05:00</TD><TD width="103.912px" height="46px">X</TD><TD width="102.963px" height="46px">20240307</TD><TD width="100.875px" height="46px">5</TD><TD width="63.95px" height="46px">C</TD><TD width="63.9375px" height="46px">C</TD><TD width="63.9625px" height="46px">C</TD><TD width="63.9375px" height="46px">P</TD><TD width="63.9375px" height="46px">X</TD><TD width="63.9375px" height="46px">X</TD><TD width="63.9375px" height="46px">X</TD><TD width="63.9375px" height="46px">X</TD><TD width="64.025px" height="46px">X</TD></TR><TR><TD width="198.887px" height="46px">2024-03-07T03:40:07.000-05:00</TD><TD width="103.912px" height="46px">X</TD><TD width="102.963px" height="46px">20240307</TD><TD width="100.875px" height="46px">5</TD><TD width="63.95px" height="46px">C</TD><TD width="63.9375px" height="46px">C</TD><TD width="63.9625px" height="46px"><FONT face="arial black,avant garde">H</FONT></TD><TD width="63.9375px" height="46px">H</TD><TD width="63.9375px" height="46px">H</TD><TD width="63.9375px" height="46px">H</TD><TD width="63.9375px" height="46px">H</TD><TD width="63.9375px" height="46px">H</TD><TD width="64.025px" height="46px">H</TD></TR><TR><TD width="198.887px" height="46px">2024-03-07T07:10:16.000-05:00</TD><TD width="103.912px" height="46px">X</TD><TD width="102.963px" height="46px">20240307</TD><TD width="100.875px" height="46px">5</TD><TD width="63.95px" height="46px">C</TD><TD width="63.9375px" height="46px">C</TD><TD width="63.9625px" height="46px">C</TD><TD width="63.9375px" height="46px">H</TD><TD width="63.9375px" height="46px">X</TD><TD width="63.9375px" height="46px">X</TD><TD width="63.9375px" height="46px">X</TD><TD width="63.9375px" height="46px">X</TD><TD width="64.025px" height="46px">X</TD></TR><TR><TD width="198.887px" height="46px">2024-03-07T07:30:17.000-05:00</TD><TD width="103.912px" height="46px">X</TD><TD width="102.963px" height="46px">20240307</TD><TD width="100.875px" height="46px">5</TD><TD width="63.95px" height="46px">C</TD><TD width="63.9375px" height="46px">C</TD><TD width="63.9625px" height="46px">C</TD><TD width="63.9375px" height="46px">I</TD><TD width="63.9375px" height="46px">X</TD><TD width="63.9375px" height="46px">X</TD><TD width="63.9375px" height="46px">X</TD><TD width="63.9375px" height="46px">X</TD><TD width="64.025px" height="46px">X</TD></TR><TR><TD width="198.887px" height="46px">2024-03-07T08:20:18.000-05:00</TD><TD width="103.912px" height="46px">X</TD><TD width="102.963px" height="46px">20240307</TD><TD width="100.875px" height="46px">5</TD><TD width="63.95px" height="46px">C</TD><TD width="63.9375px" height="46px">C</TD><TD width="63.9625px" height="46px">C</TD><TD width="63.9375px" height="46px">C</TD><TD width="63.9375px" height="46px">I</TD><TD width="63.9375px" height="46px">C</TD><TD width="63.9375px" height="46px">I</TD><TD width="63.9375px" height="46px">C</TD><TD width="64.025px" height="46px">C</TD></TR><TR><TD width="198.887px" height="46px">2024-03-07T08:30:22.000-05:00</TD><TD width="103.912px" height="46px"><FONT face="arial black,avant garde">C</FONT></TD><TD width="102.963px" height="46px">20240307</TD><TD width="100.875px" height="46px">5</TD><TD width="63.95px" height="46px">C</TD><TD width="63.9375px" height="46px">C</TD><TD width="63.9625px" height="46px">C</TD><TD width="63.9375px" height="46px">C</TD><TD width="63.9375px" height="46px">C</TD><TD width="63.9375px" height="46px">C</TD><TD width="63.9375px" height="46px">C</TD><TD width="63.9375px" height="46px">C</TD><TD width="64.025px" height="46px">C</TD></TR><TR><TD width="198.887px" height="46px">2024-03-07T010:30:10.000-05:00</TD><TD width="103.912px" height="46px">X</TD><TD width="102.963px" height="46px">20240307</TD><TD width="100.875px" height="46px">5</TD><TD width="63.95px" height="46px">C</TD><TD width="63.9375px" height="46px">C</TD><TD width="63.9625px" height="46px">C</TD><TD width="63.9375px" height="46px">P</TD><TD width="63.9375px" height="46px">X</TD><TD width="63.9375px" height="46px">X</TD><TD width="63.9375px" height="46px">X</TD><TD width="63.9375px" height="46px">X</TD><TD width="64.025px" height="46px">X</TD></TR><TR><TD width="198.887px" height="46px">2024-03-07T22:40:07.000-05:00</TD><TD width="103.912px" height="46px">X</TD><TD width="102.963px" height="46px">20240307</TD><TD width="100.875px" height="46px">5</TD><TD width="63.95px" height="46px">C</TD><TD width="63.9375px" height="46px">C</TD><TD width="63.9625px" height="46px"><FONT face="arial black,avant garde">H</FONT></TD><TD width="63.9375px" height="46px">H</TD><TD width="63.9375px" height="46px">H</TD><TD width="63.9375px" height="46px">H</TD><TD width="63.9375px" height="46px">H</TD><TD width="63.9375px" height="46px">H</TD><TD width="64.025px" height="46px">H</TD></TR><TR><TD width="198.887px" height="46px">2024-03-07T22:10:16.000-05:00</TD><TD width="103.912px" height="46px">X</TD><TD width="102.963px" height="46px">20240307</TD><TD width="100.875px" height="46px">5</TD><TD width="63.95px" height="46px">C</TD><TD width="63.9375px" height="46px">C</TD><TD width="63.9625px" height="46px">C</TD><TD width="63.9375px" height="46px"><FONT face="arial black,avant garde">H</FONT></TD><TD width="63.9375px" height="46px">X</TD><TD width="63.9375px" height="46px">X</TD><TD width="63.9375px" height="46px">X</TD><TD width="63.9375px" height="46px">X</TD><TD width="64.025px" height="46px">X</TD></TR><TR><TD width="198.887px" height="46px">2024-03-07T23:30:17.000-05:00</TD><TD width="103.912px" height="46px">X</TD><TD width="102.963px" height="46px">20240308</TD><TD width="100.875px" height="46px">5</TD><TD width="63.95px" height="46px">C</TD><TD width="63.9375px" height="46px">C</TD><TD width="63.9625px" height="46px">C</TD><TD width="63.9375px" height="46px">I</TD><TD width="63.9375px" height="46px">X</TD><TD width="63.9375px" height="46px">X</TD><TD width="63.9375px" height="46px">X</TD><TD width="63.9375px" height="46px">X</TD><TD width="64.025px" height="46px">X</TD></TR><TR><TD width="198.887px" height="46px">2024-03-07T00:20:18.000-05:00</TD><TD width="103.912px" height="46px">X</TD><TD width="102.963px" height="46px">20240308</TD><TD width="100.875px" height="46px">5</TD><TD width="63.95px" height="46px">C</TD><TD width="63.9375px" height="46px">C</TD><TD width="63.9625px" height="46px">C</TD><TD width="63.9375px" height="46px">C</TD><TD width="63.9375px" height="46px">I</TD><TD width="63.9375px" height="46px">C</TD><TD width="63.9375px" height="46px">I</TD><TD width="63.9375px" height="46px">C</TD><TD width="64.025px" height="46px">C</TD></TR><TR><TD width="198.887px" height="46px">2024-03-08T08:30:22.000-05:00</TD><TD width="103.912px" height="46px"><FONT face="arial black,avant garde">C</FONT></TD><TD width="102.963px" height="46px">20240308</TD><TD width="100.875px" height="46px">5</TD><TD width="63.95px" height="46px">C</TD><TD width="63.9375px" height="46px">C</TD><TD width="63.9625px" height="46px">C</TD><TD width="63.9375px" height="46px">C</TD><TD width="63.9375px" height="46px">C</TD><TD width="63.9375px" height="46px">C</TD><TD width="63.9375px" height="46px">C</TD><TD width="63.9375px" height="46px">C</TD><TD width="64.025px" height="46px">C</TD></TR></TBODY></TABLE> Wed, 08 May 2024 18:13:51 GMT https://community.splunk.com/t5/Splunk-Search/status-of-held-Data-has-to-complete-with-in-the-day-itself/m-p/686907#M234278 Anud 2024-05-08T18:13:51Z https://community.splunk.com/t5/Splunk-Search/status-of-held-Data-has-to-complete-with-in-the-day-itself/m-p/686908#M234279 <P>"<SPAN>when the status is H and it has to complete within the day itself." - how is this determined from the data?</SPAN></P> Wed, 08 May 2024 17:08:00 GMT https://community.splunk.com/t5/Splunk-Search/status-of-held-Data-has-to-complete-with-in-the-day-itself/m-p/686908#M234279 ITWhisperer 2024-05-08T17:08:00Z https://community.splunk.com/t5/Splunk-Search/status-of-held-Data-has-to-complete-with-in-the-day-itself/m-p/686910#M234280 <P>comparing both _time and DT and the NUM (different num will be there). In the sample data i have same NUM.</P> Wed, 08 May 2024 17:15:37 GMT https://community.splunk.com/t5/Splunk-Search/status-of-held-Data-has-to-complete-with-in-the-day-itself/m-p/686910#M234280 Anud 2024-05-08T17:15:37Z https://community.splunk.com/t5/Splunk-Search/status-of-held-Data-has-to-complete-with-in-the-day-itself/m-p/686913#M234282 <P>You haven't really explained how you get to a count of 2 given your sample data. Please can you explain your process?</P> Wed, 08 May 2024 17:49:57 GMT https://community.splunk.com/t5/Splunk-Search/status-of-held-Data-has-to-complete-with-in-the-day-itself/m-p/686913#M234282 ITWhisperer 2024-05-08T17:49:57Z https://community.splunk.com/t5/Splunk-Search/status-of-held-Data-has-to-complete-with-in-the-day-itself/m-p/686915#M234283 <P><BR />H status at&nbsp;</P><TABLE width="403px"><TBODY><TR><TD width="197.65px" height="46px">2024-03-07T01:50:00.000-05:00</TD><TD width="102.625px" height="46px">X</TD><TD width="101.925px" height="46px">20240307</TD></TR></TBODY></TABLE><TABLE width="403px"><TBODY><TR><TD width="197.65px" height="46px">2024-03-07T03:40:07.000-05:00</TD><TD width="102.625px" height="46px">X</TD><TD width="101.925px" height="46px">20240307</TD></TR></TBODY></TABLE><P><BR />C status at&nbsp;</P><TABLE width="403px"><TBODY><TR><TD width="197.65px" height="46px">2024-03-07T08:30:22.000-05:00</TD><TD width="102.625px" height="46px"><FONT face="arial black,avant garde">C</FONT></TD><TD width="101.925px" height="46px">20240307</TD></TR></TBODY></TABLE><TABLE width="403px"><TBODY><TR><TD width="197.65px" height="46px">2024-03-07T08:30:22.000-05:00</TD><TD width="102.625px" height="46px"><FONT face="arial black,avant garde">C</FONT></TD><TD width="101.925px" height="46px">20240307</TD></TR></TBODY></TABLE><P><BR /><BR />So here count 2&nbsp;<BR /><BR />One more H status at&nbsp;</P><TABLE width="815px"><TBODY><TR><TD width="480.225px" height="46px">2024-03-07T22:40:07.000-05:00</TD><TD width="246.363px" height="46px">X</TD><TD width="87.6125px" height="46px">20240307</TD></TR></TBODY></TABLE><P><BR />But its not completed within the day</P><TABLE width="1083"><TBODY><TR><TD width="198.887px" height="46px">2024-03-08T08:30:22.000-05:00</TD><TD width="103.912px" height="46px"><FONT face="arial black,avant garde">C</FONT></TD><TD width="102.963px" height="46px">20240308</TD></TR></TBODY></TABLE><P><BR /><BR /></P> Wed, 08 May 2024 18:13:24 GMT https://community.splunk.com/t5/Splunk-Search/status-of-held-Data-has-to-complete-with-in-the-day-itself/m-p/686915#M234283 Anud 2024-05-08T18:13:24Z https://community.splunk.com/t5/Splunk-Search/status-of-held-Data-has-to-complete-with-in-the-day-itself/m-p/686988#M234304 <P>So why not just count the C's in one day?</P> Thu, 09 May 2024 08:19:57 GMT https://community.splunk.com/t5/Splunk-Search/status-of-held-Data-has-to-complete-with-in-the-day-itself/m-p/686988#M234304 ITWhisperer 2024-05-09T08:19:57Z https://community.splunk.com/t5/Splunk-Search/status-of-held-Data-has-to-complete-with-in-the-day-itself/m-p/686994#M234307 <P>We need to know particularly about how many H status were coming to C within the day(12AM to11:59PM).<BR /><BR /></P> Thu, 09 May 2024 09:41:38 GMT https://community.splunk.com/t5/Splunk-Search/status-of-held-Data-has-to-complete-with-in-the-day-itself/m-p/686994#M234307 Anud 2024-05-09T09:41:38Z https://community.splunk.com/t5/Splunk-Search/status-of-held-Data-has-to-complete-with-in-the-day-itself/m-p/687040#M234324 <P>How do you determine what the day is because in your example DT doesn't always equate to the date shown in _time?</P> Thu, 09 May 2024 13:48:02 GMT https://community.splunk.com/t5/Splunk-Search/status-of-held-Data-has-to-complete-with-in-the-day-itself/m-p/687040#M234324 ITWhisperer 2024-05-09T13:48:02Z https://community.splunk.com/t5/Splunk-Search/status-of-held-Data-has-to-complete-with-in-the-day-itself/m-p/687045#M234327 <P>Assuming DT is the date you want to use and you already have your data in this format, try this</P><LI-CODE lang="markup">| untable DT category state | where state="H" or (category="OVERAL" and state="C") | streamstats window=1 current=f values(state) as previous by DT | where state="C" and previous="H" | stats count</LI-CODE> Thu, 09 May 2024 14:11:41 GMT https://community.splunk.com/t5/Splunk-Search/status-of-held-Data-has-to-complete-with-in-the-day-itself/m-p/687045#M234327 ITWhisperer 2024-05-09T14:11:41Z https://community.splunk.com/t5/Splunk-Search/status-of-held-Data-has-to-complete-with-in-the-day-itself/m-p/687079#M234341 <P>Thanks for your query!<BR />I have applied logic along with query, it working as expected.<BR />please let me know earliest and latest logic for 12:00 AM to 11:59PM.</P> Thu, 09 May 2024 17:30:04 GMT https://community.splunk.com/t5/Splunk-Search/status-of-held-Data-has-to-complete-with-in-the-day-itself/m-p/687079#M234341 Anud 2024-05-09T17:30:04Z https://community.splunk.com/t5/Splunk-Search/status-of-held-Data-has-to-complete-with-in-the-day-itself/m-p/687102#M234351 <P>I am glad it works - what does your query about earliest and latest mean?</P> Thu, 09 May 2024 22:03:40 GMT https://community.splunk.com/t5/Splunk-Search/status-of-held-Data-has-to-complete-with-in-the-day-itself/m-p/687102#M234351 ITWhisperer 2024-05-09T22:03:40Z