Splunk Enterprise Security

Automatically recognize if all data behave the same at night / on weekends / on public holidays--> determine time period for gap in my graph

New Member


When I plot a timechart, there are some empty buckets, which causes a gap in my graph.
In these gaps (values with 0 events) you can see from the time chart that there are significantly fewer or no events at night, at the weekend, on a holiday.
Is it possible to recognize automatically, from which time period (e.g. "every day from 04 to 06 tomorrow earlier" or "on weekends from 20 o'clock to 07 o'clock earlier) no data (0 events) are sent? Does this trend apply to all data values or only to certain data values?

Time diagram I have determined the following measures:
index="xyz" sourcetype="st_http" | bucket span=10m _time | chart count over _time by ID | foreach * [eval <> = if(isnull('<>'), 0, '<>')] | appendcols [ | lookup N_lookup phone as ID output m n | search town="Frankfurt"]

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...