Splunk Search

How can I do timechart (or something similar) starting from a specific minute?

dpanych
Communicator

I have an alert that runs every hour at the half hour mark. So at 1:30, 2:30, etc... When I run the timechart command, "| timechart count span=1h", it brings back the count of events for each hour, but I want the count of event from 1:30 to 2:30. How can I accomplish this?

(index=ABC Page="go.aspx" Refer="*signup_pro.aspx" UserName=*)
OR (index=ABC Page="signup_pro.aspx" (SID3Type=A1 OR SID3Type=A2) UserName=* SID1=* SID3=*)
OR (index=ABC Page="Registration.aspx" UserName=*)
| transaction UserName, SessionSID maxspan=60m
| table _time, UserName, SID3, SID3Type, SID1, FName1, LName1, Email, Page
| sort - _time
| search UserName=* SID1=* SID3=* SID3Type=* FName1=* LName1=* Email=* Page=go.aspx
| rename UserName AS UserSID, SID1 AS "SID1 (SSN)", FName1 AS FirstName, LName1 AS LastName
| fields - Page
0 Karma

somesoni2
Revered Legend

Try this

(index=ABC Page="go.aspx" Refer="*signup_pro.aspx" UserName=*)
 OR (index=ABC Page="signup_pro.aspx" (SID3Type=A1 OR SID3Type=A2) UserName=* SID1=* SID3=*)
 OR (index=ABC Page="Registration.aspx" UserName=*)
 | transaction UserName, SessionSID maxspan=60m
 | table _time, UserName, SID3, SID3Type, SID1, FName1, LName1, Email, Page
 | sort - _time
 | search UserName=* SID1=* SID3=* SID3Type=* FName1=* LName1=* Email=* Page=go.aspx
 | rename UserName AS UserSID, SID1 AS "SID1 (SSN)", FName1 AS FirstName, LName1 AS LastName
 | fields - Page | eval _time=_time-1800
| timechart span=1h ...put your functions here that you need...
| eval _time=_time+1800
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...