Getting Data In

Getting logs for after hours access

kengilmour
Path Finder

Hello,

I want to be able to get logs from Splunk for anyone who came in to the building between 7PM and 7AM the next morning, and search back for the last 30 days but I'm having a difficult time finding out how to do it.

I've tried this:

index="main" source="accesscontrol.csv" | timechart count by User

But it truncates it down to just a few users and adds the rest of the users as "other". I'd just like a table of all users who were in the building between those hours.

Thanks!

Ken

Tags (1)
1 Solution

dwaddle
SplunkTrust
SplunkTrust

If you want a table, a timechart is probably not the route you want to take. You might want to do something like this:

index="main" source="accesscontrol.csv" 
| eval access_hour=strftime(_time,"%H")
| where ( access_hour >= 19 OR access_hour < 7  ) 
| table _time,User

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

If you want a table, a timechart is probably not the route you want to take. You might want to do something like this:

index="main" source="accesscontrol.csv" 
| eval access_hour=strftime(_time,"%H")
| where ( access_hour >= 19 OR access_hour < 7  ) 
| table _time,User

dwaddle
SplunkTrust
SplunkTrust

Excellent. Could you accept the answer please, by clicking on the checkbox to the left?

0 Karma

kengilmour
Path Finder

That's excellent, thanks very much, it worked!

0 Karma

yannK
Splunk Employee
Splunk Employee

or directly date_hour.

index="main" source="accesscontrol.csv" (date_hour <7 OR date_hour>=19)
| stats count values(date_hour) AS list_of_hours by User

jwalzerpitt
Influencer

If I wanted to get the count per user would the following be correct:

index="main" source=accesscontrol.csv"
| eval access_hour=strftime(_time,"%H") | where ( access_hour >= 19 OR access_hour < 7 )

| table _time,User | top 10 User showperc=false

Thx

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Can you post an example of what is located in accesscontrol.csv?

0 Karma
Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...