Hello,
I want to be able to get logs from Splunk for anyone who came in to the building between 7PM and 7AM the next morning, and search back for the last 30 days but I'm having a difficult time finding out how to do it.
I've tried this:
index="main" source="accesscontrol.csv" | timechart count by User
But it truncates it down to just a few users and adds the rest of the users as "other". I'd just like a table of all users who were in the building between those hours.
Thanks!
Ken
If you want a table, a timechart
is probably not the route you want to take. You might want to do something like this:
index="main" source="accesscontrol.csv"
| eval access_hour=strftime(_time,"%H")
| where ( access_hour >= 19 OR access_hour < 7 )
| table _time,User
If you want a table, a timechart
is probably not the route you want to take. You might want to do something like this:
index="main" source="accesscontrol.csv"
| eval access_hour=strftime(_time,"%H")
| where ( access_hour >= 19 OR access_hour < 7 )
| table _time,User
Excellent. Could you accept the answer please, by clicking on the checkbox to the left?
That's excellent, thanks very much, it worked!
or directly date_hour.
index="main" source="accesscontrol.csv" (date_hour <7 OR date_hour>=19)
| stats count values(date_hour) AS list_of_hours by User
If I wanted to get the count per user would the following be correct:
index="main" source=accesscontrol.csv"
| eval access_hour=strftime(_time,"%H") | where ( access_hour >= 19 OR access_hour < 7 )
| table _time,User | top 10 User showperc=false
Thx
Can you post an example of what is located in accesscontrol.csv?