How do I get an hourly result table from a single monthly event?

[sndegwa]

I have monthly events feeding into splunk. However I need each monthly event to be repeated for each hour of the month during the search. How do I achieve this?

Example :
Monthly Event - 1/1/2014,TEST, FIELD1,FIELD2...

Hourly results :
1/1/2014 00:00:00 ,TEST, FIELD1, FIELD2...
1/1/2014 01:00:00 ,TEST, FIELD1, FIELD2...
1/1/2014 02:00:00 ,TEST, FIELD1, FIELD2...
etc

[vganjare · Accepted solution]

Hi,

You can try using gentimes command along with join command. Try following query:

| gentimes start=05/13/15 end=05/14/15 increment=1h | eval joinme="YES" | join joinme [|... your search ...| eval joinme="YES" ]

Thanks!!

[sndegwa]

Thanks! This works great.