Reporting

How do you set up a time range from 7 pm to 2 pm for a scheduled hourly report?

shaikhussain2
Explorer

We had set up a report which triggers on an hourly basis from 8PM to 2PM (earliest = -1d@d+20h & latest = @d+14h) but we are getting correct reports starting from 12:00 AM only and before that its taking last 24 hours report (9PM, 10PM, 11PM reports).

Thanks,
Shaik Hussain

0 Karma
1 Solution

datasearchninja
Communicator

You need to add some hours into the calculation to shift the base hours into the next day when it is somewhere between 8pm -> midnight

So:
earliest=+4h@d-4h
When it is between midnight and 8pm, this will calculate to 8pm yesterday, after 8pm it will be 8pm today

latest=+4h@d+14h
When it is between midnight and 8pm, this will calculate to 2pm today, after 8pm it will be 2pm tommorrow

View solution in original post

0 Karma

datasearchninja
Communicator

You need to add some hours into the calculation to shift the base hours into the next day when it is somewhere between 8pm -> midnight

So:
earliest=+4h@d-4h
When it is between midnight and 8pm, this will calculate to 8pm yesterday, after 8pm it will be 8pm today

latest=+4h@d+14h
When it is between midnight and 8pm, this will calculate to 2pm today, after 8pm it will be 2pm tommorrow

0 Karma

shaikhussain2
Explorer

Thanks colin, It is working perfectly now and thanks for elaborating the answer.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...