Splunk Search

Filtering a weekly timewrap timechart by a specific time window each day.

jbrenner
Path Finder

I have the following query that gives me week-over-week comparisons for the past month:

 

index="myIndex" earliest=-1mon "my query" | timechart count as Visits | timewrap w

 

I have added dropdowns to my dashboard to filter this data by a user-selected time window for every day in the one month range.  The four dropdowns correspond to the start hour, start minute, end hour, and end minute of the time window in military time.  For example, to filter the data by 6:30 AM - 1:21 PM each day, the tokens would have the following values:

 

$start_hour_token$: '6'
$start_minute_token$: '30' 
$end_hour_token$: '13' 
$end_minute_token$: '21' 

 

How would I modify the original query to make ths work?

Thanks! Jonathan

Labels (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Do you have the date_* fields in your data?

If so, you can do this

search... earliest=-1mon (date_hour>=$start_hour_token$ date_minute>=$start_minute_token$) (date_hour<$end_hour_token$ OR (date_hour=$end_hour_token$ date_minute<$end_minute_token$)))

If you don't have those fields extracted, then you will have to do an eval statement to create the date_hour and date_minute fields and then do a where clause to do the same comparison as above.

0 Karma
Get Updates on the Splunk Community!

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...

Stay Connected: Your Guide to October Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...