Splunk Search

How can I do timechart (or something similar) starting from a specific minute?

dpanych
Communicator

I have an alert that runs every hour at the half hour mark. So at 1:30, 2:30, etc... When I run the timechart command, "| timechart count span=1h", it brings back the count of events for each hour, but I want the count of event from 1:30 to 2:30. How can I accomplish this?

(index=ABC Page="go.aspx" Refer="*signup_pro.aspx" UserName=*)
OR (index=ABC Page="signup_pro.aspx" (SID3Type=A1 OR SID3Type=A2) UserName=* SID1=* SID3=*)
OR (index=ABC Page="Registration.aspx" UserName=*)
| transaction UserName, SessionSID maxspan=60m
| table _time, UserName, SID3, SID3Type, SID1, FName1, LName1, Email, Page
| sort - _time
| search UserName=* SID1=* SID3=* SID3Type=* FName1=* LName1=* Email=* Page=go.aspx
| rename UserName AS UserSID, SID1 AS "SID1 (SSN)", FName1 AS FirstName, LName1 AS LastName
| fields - Page
0 Karma

somesoni2
Revered Legend

Try this

(index=ABC Page="go.aspx" Refer="*signup_pro.aspx" UserName=*)
 OR (index=ABC Page="signup_pro.aspx" (SID3Type=A1 OR SID3Type=A2) UserName=* SID1=* SID3=*)
 OR (index=ABC Page="Registration.aspx" UserName=*)
 | transaction UserName, SessionSID maxspan=60m
 | table _time, UserName, SID3, SID3Type, SID1, FName1, LName1, Email, Page
 | sort - _time
 | search UserName=* SID1=* SID3=* SID3Type=* FName1=* LName1=* Email=* Page=go.aspx
 | rename UserName AS UserSID, SID1 AS "SID1 (SSN)", FName1 AS FirstName, LName1 AS LastName
 | fields - Page | eval _time=_time-1800
| timechart span=1h ...put your functions here that you need...
| eval _time=_time+1800
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...