topic Re: How do I get a search with "timechart span=1d" to return and display events from the top of the hour? in Splunk Search

How do I get a search with "timechart span=1d" to return and display events from the top of the hour?

Vignesh5r — Mon, 15 Aug 2016 20:07:56 GMT

I have a search like below.

If i run this search, let's say now, it fetches transaction (as per the display ) not from the TOP of the hour, but from the time I have run the search.

Let's say I run this for the last 7 days.
It takes only from 8/8 15:00 hrs till now and not 8/8 00:00 hrs until now.

I tried 1d and as well as 24 hours, but same thing. How do we have the result fetched from the top of the hour?

index!=_internal "test" |  rex "(?i)fieldname1=(?P[^]]+)" | dedup FIELDNAME | timechart span=1d count

Re: How do I get a search with "timechart span=1d" to return and display events from the top of the hour?

sundareshr — Mon, 15 Aug 2016 20:27:19 GMT

Try this

index!=_internal "test" earliest="-7@d" |  rex "(?i)fieldname1=(?P[^]]+)" | dedup FIELDNAME | timechart span=1d count

Re: How do I get a search with "timechart span=1d" to return and display events from the top of the hour?

Masa — Mon, 15 Aug 2016 20:46:42 GMT

sundareshr typo ? earliest="-7d@d"

https://docs.splunk.com/Documentation/Splunk/6.4.2/Search/Specifytimemodifiersinyoursearch

Re: How do I get a search with "timechart span=1d" to return and display events from the top of the hour?

Vignesh5r — Mon, 15 Aug 2016 21:01:02 GMT

Thanks Sundar. This works. With the correction provided, i am indicatig the final query which worked and took transactions from 00:00 hrs 7 days ago till now.

index!=_internal "test" earliest="-7@d@d" |  rex "(?i)fieldname1=(?P[^]]+)" | dedup FIELDNAME | timechart span=1d count

Thanks once again Sundar

Re: How do I get a search with "timechart span=1d" to return and display events from the top of the hour?

Vignesh5r — Mon, 15 Aug 2016 21:01:38 GMT

Thanks Masa!!