Reporting

Report results for each hour in a day

Explorer

Hello! I have a report and wanna have results for each hour for the last day (last 24 hours).
I.e. it would be like this:

00:00 - 00:59 - result 1
01:00 - 01:59 - result 2
...
23:00-23:59 - result 24

And I have a dashboard where I want to see my 24 last results.
How can I do it?

0 Karma

Splunk Employee
Splunk Employee

You can do the following:

|bin _time span=1h
|eval timerange = strftime(_time, "%H:%M - %H:59")
|stats count by timerange
0 Karma

Esteemed Legend

You should use timechart span=1h to generate your tabular data and then do | head 24 at the end to only keep the last 24 hours.

0 Karma

Influencer

Hi

A good way to get results over time is

|timechart

Something like your search earliest=-24h| timechart span=1h count
Then you can display that as chart or diagram

0 Karma

Explorer

My data visualization type is a table. I have a dashbord and want to have there all 24 reports. I.e. a result for each hour

0 Karma

Influencer

Can post your search query?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!