Dashboards & Visualizations

how to retrieve one week data only between 6pm to 9pm

mvaradarajam
Path Finder

Hi All,
how to retrieve one week data only between 6pm to 9pm.in 1 day span

monday--- 6pm-9pm
tuesday----6pm--9pm

like that?

Tags (1)
0 Karma

Ayn
Legend

In addition to both these answers it's important to note that the date_* fields do NOT always exist in events. It only exists for events where the timestamp processor has parsed the timestamp. This is not the case for Windows event logs sent from a forwarder, for instance. If you want to make sure you always have the field date_hour, you could do something like this:

... | eval date_hour=strftime(_time,"%H") | ...
0 Karma

digdug
New Member

If you want to summarize data by day for events between 6pm and 9pm, this should get you started:

YOUR_BASIC_QUERY_HERE (date_hour>=18 AND date_hour<21) earliest=@w1 latest=@w6 | timechart span=1d count

Given your example, I assume you want results for Monday through Friday. If you wanted the full week, use earliest=@w0 latest=@w6+d.

0 Karma

kristian_kolb
Ultra Champion

Normally the retreival can be done like this;

index=bleh sourcetype=blah earliest=-7d date_hour>17 OR date_hour<21

Then you must figure out if/how you want to report on that data, i.e. making some statistics, graphs etc etc.

/K

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!