How do I group and identify a set of events based on a time range?

[hans]

Let say I have events coming in everyday and I want to group the events as Monday's events, Tuesday's events, and so on. How do I do that?

[hulahoop]

Also, Splunk provides default datetime fields to aid in time-based grouping/searching. These fields are available on any event:

• date_second
• date_minute
• date_hour
• date_mday (the day of the month)
• date_wday (the day of the week)
• date_month
• date_year

To group events by day of the week, let's say for Monday, use date_wday=monday. If grouping by day of the week in a chart try:

... | timechart span=1d count by date_wday

More details and examples are available here: http://docs.splunk.com/Documentation/Splunk/5.0/Knowledge/Usedefaultfields#Default_datetime_fields

Happy dating! 😉

[gkanapathy · Accepted solution]

If the incoming events have time stamps already on them, or the time stamp is in the file name, you can configure Splunk to parse the time stamp and apply it to the events. Many time formats will be automatically recognized, or you can specify one explicity with settings available in props.conf.

When you view them, you can ask for any time range of events, or use reporting commands to group them by any span of time, e.g. sourcetype=mydate earliest=-60d latest=-1d | timechart span=1d count

If the events are not stamped with a time, and you want to indicate their time using the current time, you can configure Splunk to stamp them the current time by using

DATETIME_CONFIG = CURRENT

for the incoming data's sourcetype (or source or host) in props.conf