topic Re: timechart span over custom period of day in Splunk Search

timechart span over custom period of day

milande — Thu, 30 Apr 2015 12:28:55 GMT

Hi together,

I would need to present count of events generated during period from 6AM at day X until 6AM at day X+1 (and so for each day).
If I simple use:
index=technology_test | timechart span=1d count

I am getting events generated over single day X and not in [6AM to next day 6AM] range.
Any idea how to limit span to hours spread over two consecutive days ?

best regards,
Milan

Re: timechart span over custom period of day

neelamssantosh — Thu, 30 Apr 2015 13:31:48 GMT

in Date & Time Range specify your earliest and latest with date and time, then hit the search.
http://docs.splunk.com/Documentation/Splunk/6.2.3/Search/Selecttimerangestoapply

Hope i will help you.

Re: timechart span over custom period of day

milande — Thu, 30 Apr 2015 13:40:53 GMT

But I need for each day span from 6AM at day X until 6AM at day X+1 (and so for each day), not just once manually edited. Generally I need chart over days not just single value for just one day.

Re: timechart span over custom period of day

neelamssantosh — Thu, 30 Apr 2015 14:06:30 GMT

if u want from yesterday 6AM to today 6AM,then use
earliest=d@d and run the report every day at 6Am using the cron job and render in your dashboard.

Re: timechart span over custom period of day

milande — Thu, 30 Apr 2015 15:12:56 GMT

My aim ist to have chart over days, not to run manually every day at 6AM. You mention "cron job" I checked right now but I do not have permission for it.
If that is not hard for you could you just provide me with search string which do that without "cron job" ? Unfortunatelly I do not understand with current Splunk knowledge how to do it.

Re: timechart span over custom period of day

fdi01 — Fri, 01 May 2015 14:21:29 GMT

try :

 index=technology_test  earliest=05/01/2015:06:0:0   | timechart per_day(eval( count)) as "count by day" | eval _time=_time + (6*60*60)

 index=technology_test  earliest=05/01/2015:06:0:0 |bucket span=1d _time  |stats count as  "count by day"  by _time  | eval _time=_time + (6*60*60)

Re: timechart span over custom period of day

milande — Fri, 01 May 2015 14:48:07 GMT

first option brought error in usage of timechart command (additionally I do not see how to parse day in tho parts after 6AM up tomorrow 6AM ?) and the second suggestion pick up all events for single day, not separating what happened before and what after 6AM. If I would use function per_hour() maybe I could filter only those in 6-24 range, where the second part from 0-6AM next day I have no clue how to filter...any idea ?

Re: timechart span over custom period of day

milande — Wed, 20 May 2015 11:00:27 GMT

Is there any option to get official Splunk support as here I could not find right answer
?

Re: timechart span over custom period of day

woodcock — Sat, 06 Jun 2015 22:01:02 GMT

This definitely does it:

 index=technology_test | eval _time=_time - (6*60*60) | bucket _time span=1d | stats count by _time | eval _time=_time + (6*60*60)

Re: timechart span over custom period of day

jvarmazis_splun — Sun, 07 Jun 2015 03:24:25 GMT

For Day X = June 5, 2015 your search would be:
index=technology_test earliest=”6/5/2015:06:00:00” latest=”6/6/2015:06:00:00” | timechart span=1d count

Re: timechart span over custom period of day

fdi01 — Sun, 07 Jun 2015 11:39:31 GMT

it is correct now with the timechart .
th.

Re: timechart span over custom period of day

woodcock — Sun, 07 Jun 2015 13:44:05 GMT

You should "Accept" whichever answer is correctest.

Re: timechart span over custom period of day

woodcock — Sun, 07 Jun 2015 21:46:20 GMT

Actually, it "looks" correct but it is not; the label has been artificially altered to appear to be from 6AM but the data elements beneath each label is only from 6AM to midnight (it is missing the next 6 hours of the next day). Check out my answer, though; it definitely works.

Re: timechart span over custom period of day

woodcock — Mon, 08 Jun 2015 03:37:11 GMT

This will yield 2 results, not 1: 1 for 6AM-Midnight on the 5th and another from Midnight to 6AM on the 6th.

Re: timechart span over custom period of day

sivasobh — Fri, 25 Nov 2016 00:26:37 GMT

I downvoted this post because 😛

Re: timechart span over custom period of day

ppablo — Mon, 05 Dec 2016 21:18:21 GMT

@sivasobh

Downvoting users should be reserved for suggestions that could be potentially harmful for someone's Splunk environment. Also, giving a reason as ":P" is inappropriate and unnecessary, and this is not how Splunk community etiquette works in this forum. The downvote form is supposed to be used to help educate the community to learn and improve based on context provided, which your reasoning does not.

Before engaging further in voting people's posts, read how voting etiquette works in Splunk Answers:
https://answers.splunk.com/answers/244111/proper-etiquette-and-timing-for-voting-here-on-ans.html