topic Re: Tabular report showing count based on time range in Splunk Search

Tabular report showing count based on time range

chintan_shah — Thu, 07 Sep 2017 17:36:40 GMT

Hi,

I need to create report in format.
Could anyone help me in achieving this.
I can have time interval of 2 hours as well if cannot have in the format.

Re: Tabular report showing count based on time range

jackson1990 — Thu, 07 Sep 2017 17:39:35 GMT

can you provide some input data? i mean with fields

Re: Tabular report showing count based on time range

chintan_shah — Thu, 07 Sep 2017 17:41:40 GMT

its just the count of events, my requirement is to show counts based on the time range.

Re: Tabular report showing count based on time range

niketn — Tue, 29 Sep 2020 15:40:33 GMT

@chintan_shah, please check out Punchcard Custom Visualization App (https://splunkbase.splunk.com/app/3129/), it will load some examples with date_hour and count, which would plot the data as per your need.

Re: Tabular report showing count based on time range

woodcock — Fri, 08 Sep 2017 04:32:25 GMT

If you just need count, this should be lightning fast:

| tstats count where index=_* BY date_wday date_hour 
| eval date_wday=case(date_wday="sunday"   , "      sunday",
                      date_wday="monday"   , "     monday",
                      date_wday="tuesday"  , "    tuesday",
                      date_wday="wednesday", "   wednesday",
                      date_wday="thursday" , "  thursday",
                      date_wday="friday"   , " friday",
                      true(), date_wday)
| chart first(count) OVER date_hour BY date_wday
| addtotals row=t col=t
| eval date_hour=if(date_hour>23, "TOTAL", date_hour)