Splunk Search

How could I look only at a defined time span in real-time-search?

Felix82
Explorer

Hi, 

 

I'm new in working with Splunk - I began to explore the program last monday...

I have the task to create a dashboard for visualizing the availibility of a machine. My working base: The machine data, additional  disorder reports by workers (implemented by tablets) and the knowledge about the working times (monday till friday, 5.30am till 10.30pm).

Now I want to use the daily data in timerange from 5.30am till 10.30pm because the availibility should only represents the disorder times in relation to real working time. How could I do that without a specified date?

 

Many Thanks and Greetings from Germany, 

Felix

Labels (1)
0 Karma

Felix82
Explorer

Hi Michel,

 

thank you for sharing your experiences! It's so difficult and extensive to get an overview around all commands and functions... I will test your parameters then give you feedback.

 

Greetings, 

Felix

0 Karma

michel_wolf
Path Finder

Hi Felix,

you need to extract these requirements from your date field to filter it. You can perform your search for example like index=.... earliest=-7d@d latest=now to get all your data from the last 7 days.

Then you can add something like this

| eval day=strftime(_time,"%u")
| search day IN (1 2 3 4 5)

| eval timestampStart="05:30:00"
| eval timestampEnd="22:30:00"
| eval timestampDate = strftime(_time,"%H:%M:%S")

| where timestampDate >= timestampStart AND timestampDate <= timestampEnd

 

Michel

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...