Dashboards & Visualizations

Want to display my result only for this time (0-12:00 UTC time) .

rajhemant26
New Member

Hello, everyone.
Want to display my result only for this time (0-12:00 UTC) for all the weekdays (Mon-Fri ).

Tags (1)
0 Karma

marycordova
SplunkTrust
SplunkTrust

add this to your base search

date_wday IN (monday,tuesday,wednesday,thursday,friday) date_hour>=0 date_hour<=12

you might need to tweak the <=12 depending on your requirements

index=dcsdjc host=awer THREAD_WALL_MS!=null date_wday IN (monday,tuesday,wednesday,thursday,friday) date_hour>=0 date_hour<=12 
| bin _time span=1h 
| streamstats count as Req by host, _time 
| eval RequestsPerMin=Req/60 
| eval RequestsPerSec=RequestsPerMin/60 
| stats avg(RequestsPerMin) as AvgRequestsPerSec, max(RequestsPerMin) as MaxRequestsPerSec, p95(RequestsPerMin) as P95RequestsPerSec by host 
| eval AvgRequestsPerSec=round(AvgRequestsPerSec,2), MaxRequestsPerSec=round(MaxRequestsPerSec,2), P95RequestsPerSec=round(P95RequestsPerSec,2) 
| sort -MaxRequestsPerSec, -P95RequestsPerSec
@marycordova
0 Karma

pkeenan87
Communicator

You should be able to do this with the date_hour & date_wday fields. You should just need to add this to the first part of your search:

date_hour>=0 date_hour<12 (date_wday=monday OR date_wday=tuesday OR date_wday=wednesday OR date_wday=thursday OR 
date_wday=friday)

Full query

index=dcsdjc host=awer THREAD_WALL_MS!=null date_hour>=0 date_hour<12 (date_wday=monday OR date_wday=tuesday OR 
date_wday=wednesday OR date_wday=thursday OR date_wday=friday) | bin _time span=1h
| streamstats count as Req by host, _time
| eval RequestsPerMin=Req/60
| eval RequestsPerSec=RequestsPerMin/60
| stats avg(RequestsPerMin) as AvgRequestsPerSec, max(RequestsPerMin) as MaxRequestsPerSec, p95(RequestsPerMin) as 
P95RequestsPerSec by host |eval AvgRequestsPerSec=round(AvgRequestsPerSec,2), 
MaxRequestsPerSec=round(MaxRequestsPerSec,2), P95RequestsPerSec=round(P95RequestsPerSec,2)|sort -MaxRequestsPerSec, - 
P95RequestsPerSec
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...