Dashboards & Visualizations

Splunk Timechart- How get data for last 7 days for a particular time range?

onthakur
Explorer

Hello,

I am looking for the timechart option where I can get data for last 7 days for a particular time range.

Ex :- if I select time range as 01:00:00 to 02:00:00 AM then should show data for last 7 days for the same time range.

Date/Time range Count
2022-05-27 01:00:00 02:00:00 A
2022-05-26 01:00:00 02:00:00 B
2022-05-25 01:00:00 02:00:00 C
2022-05-24 01:00:00 02:00:00 D
2022-05-23 01:00:00 02:00:00 E
2022-05-22 01:00:00 02:00:00 F
2022-05-21 01:00:00 02:00:00 G

 

Thanks

 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @onthakur,

if you have the "date_hour" field you can use the following search:

index=your_index time_hour=1 earliest=-7d latest=now
| timechart span=1d count

If yu haven't the above field you have to extract it:

index=your_index earliest=-7d latest=now
| eval time_hour=strftime(_time,"%H")
| where time_hour=1
| timechart span=1d count

Ciao.

Giuseppe

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Don't use the time_hour fields! At least unless you understand how it works.

https://docs.splunk.com/Documentation/Splunk/8.2.6/Knowledge/Usedefaultfields

About the date_* fields:

"These are fields that provide additional searchable granularity to event timestamps.

Note: Only events that have timestamp information in them as generated by their respective systems will have date_* fields. If an event has a date_* field, it represents the value of time/date directly from the event itself. If you have specified any timezone conversions or changed the value of the time/date at indexing or input time (for example, by setting the timestamp to be the time at index or input time), these fields will not represent that."

So if have some form of timezone inconsistency between the raw timestamp data in the event and the timezone you're working with, you will have wrong results when working on those date_* results.

0 Karma
Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...