Splunk Enterprise Security

Automatically recognize if all data behave the same at night / on weekends / on public holidays--> determine time period for gap in my graph

New Member


When I plot a timechart, there are some empty buckets, which causes a gap in my graph.
In these gaps (values with 0 events) you can see from the time chart that there are significantly fewer or no events at night, at the weekend, on a holiday.
Is it possible to recognize automatically, from which time period (e.g. "every day from 04 to 06 tomorrow earlier" or "on weekends from 20 o'clock to 07 o'clock earlier) no data (0 events) are sent? Does this trend apply to all data values or only to certain data values?

Time diagram I have determined the following measures:
index="xyz" sourcetype="st_http" | bucket span=10m _time | chart count over _time by ID | foreach * [eval <> = if(isnull('<>'), 0, '<>')] | appendcols [ | lookup N_lookup phone as ID output m n | search town="Frankfurt"]

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...