Dashboards & Visualizations

Splunk Timechart- How get data for last 7 days for a particular time range?

onthakur
Engager

Hello,

I am looking for the timechart option where I can get data for last 7 days for a particular time range.

Ex :- if I select time range as 01:00:00 to 02:00:00 AM then should show data for last 7 days for the same time range.

Date/Time range Count
2022-05-27 01:00:00 02:00:00 A
2022-05-26 01:00:00 02:00:00 B
2022-05-25 01:00:00 02:00:00 C
2022-05-24 01:00:00 02:00:00 D
2022-05-23 01:00:00 02:00:00 E
2022-05-22 01:00:00 02:00:00 F
2022-05-21 01:00:00 02:00:00 G

 

Thanks

 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @onthakur,

if you have the "date_hour" field you can use the following search:

index=your_index time_hour=1 earliest=-7d latest=now
| timechart span=1d count

If yu haven't the above field you have to extract it:

index=your_index earliest=-7d latest=now
| eval time_hour=strftime(_time,"%H")
| where time_hour=1
| timechart span=1d count

Ciao.

Giuseppe

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Don't use the time_hour fields! At least unless you understand how it works.

https://docs.splunk.com/Documentation/Splunk/8.2.6/Knowledge/Usedefaultfields

About the date_* fields:

"These are fields that provide additional searchable granularity to event timestamps.

Note: Only events that have timestamp information in them as generated by their respective systems will have date_* fields. If an event has a date_* field, it represents the value of time/date directly from the event itself. If you have specified any timezone conversions or changed the value of the time/date at indexing or input time (for example, by setting the timestamp to be the time at index or input time), these fields will not represent that."

So if have some form of timezone inconsistency between the raw timestamp data in the event and the timezone you're working with, you will have wrong results when working on those date_* results.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...