Dashboards & Visualizations

Splunk Timechart- How get data for last 7 days for a particular time range?

onthakur
Explorer

Hello,

I am looking for the timechart option where I can get data for last 7 days for a particular time range.

Ex :- if I select time range as 01:00:00 to 02:00:00 AM then should show data for last 7 days for the same time range.

Date/Time range Count
2022-05-27 01:00:00 02:00:00 A
2022-05-26 01:00:00 02:00:00 B
2022-05-25 01:00:00 02:00:00 C
2022-05-24 01:00:00 02:00:00 D
2022-05-23 01:00:00 02:00:00 E
2022-05-22 01:00:00 02:00:00 F
2022-05-21 01:00:00 02:00:00 G

 

Thanks

 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @onthakur,

if you have the "date_hour" field you can use the following search:

index=your_index time_hour=1 earliest=-7d latest=now
| timechart span=1d count

If yu haven't the above field you have to extract it:

index=your_index earliest=-7d latest=now
| eval time_hour=strftime(_time,"%H")
| where time_hour=1
| timechart span=1d count

Ciao.

Giuseppe

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Don't use the time_hour fields! At least unless you understand how it works.

https://docs.splunk.com/Documentation/Splunk/8.2.6/Knowledge/Usedefaultfields

About the date_* fields:

"These are fields that provide additional searchable granularity to event timestamps.

Note: Only events that have timestamp information in them as generated by their respective systems will have date_* fields. If an event has a date_* field, it represents the value of time/date directly from the event itself. If you have specified any timezone conversions or changed the value of the time/date at indexing or input time (for example, by setting the timestamp to be the time at index or input time), these fields will not represent that."

So if have some form of timezone inconsistency between the raw timestamp data in the event and the timezone you're working with, you will have wrong results when working on those date_* results.

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...