How do I count time differently than 00:00 ~ 24:00?

[hyungjoon]

Question)
If my store is open through 1pm~2am and I want to see how many chickens I sold on one day, Splunk would count the
chickens I sold from 12am~2am to the next day and count the chickens I sold the day before.

I want to make a line chart of this but the calculations are wrong because of this.

Can anybody help?

[nswondem · Accepted solution]

Hi hyngjoon,

The goal would be to identify whether an event occurred yesterday or today, then compare the datehours.

1. Calculate the start of yesterday
2. Calculate the start of today
3. Get the datehour using strftime
4. Convert the hr to a number (since it is a string)
5. Determine whether the event time is yesterday and the hour is after 12pm OR whether the event time is today and the hour is before 2am.

Nadine
...
| eval yesterday=relative_time(now(), "-1d@d")
| eval today=relative_time(now(), "@d")
| eval hr=strftime(_time, "%H")
| eval hr=tonumber(hr)
| where (_time >= yesterday AND hr > 12) OR (_time >= today AND hr <=2)