All Apps and Add-ons

Timewrap a 10 minute period of each day, by minute, over past 3-4 weeks?

Explorer

I have a set of results which happen to occur between 4:59pm and 5:08pm each day. How can I timewrap these results with a 1 minute (x) interval?

0 Karma

Explorer

I (almost? maybe?) solved it - but would be interested in better ways to do this:

My solution was to add the "where" clause seen below:

| timechart span=m count
| timewrap d
| where (strftime(_time, "%H:%M") > "16:58" AND strftime(_time, "%H:%M") < "17:09")

HOWEVER: The count of values in the resulting chart are really low. I had 1200 results in the 10 minute timeframe but the bar graph showed about half of that amount.

I got a better graph using:
(date_mday!=22 AND date_hour!=8) ((date_hour=16 AND date_minute="59") OR (date_hour="17" AND date_minute<"9"))
| chart count by date_minute, date_mday

but that returns a graph with x showing 0,1,2,3,4,8,59 (the minute values) - where 59 is biggest but should be first (4:59pm vs 5:0x)

0 Karma

Explorer

To clarify, I was getting a "truncated results" message when trying like:

| timechart span=m count

| timewrap d

and I was able to get it to display properly as:

| timechart span=m count

| timewrap d

| where (strftime(_time, "%H:%M") > "16:58" AND strftime(_time, "%H:%M") < "17:09")

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!