Splunk Search

How to edit my search to retrieve three 15 minute spans of data per day for a specified date range?

nmohammed
Contributor

I am trying to get data from splunk on the following basis :

get data :

• From June 19 to July 2
• Every day:
o 10:00 AM to 10:15 AM
o 12:00 noon to 12:15 PM
o 2:00 PM to 2:15 PM

I have been using different searches with strftime, but getting 0 results. When I do a search on a per day basis, I am seeing numbers coming up.

My search:

sourcetype=abc type=xyz clientid=123  | eval myHour=strftime(_time, "%H") | eval myMin=strftime(_time, "%M") | where ( myHour <= 10 AND myMin >=00) AND (myHour > 10 AND myMin <=15) | stats count as Calls by _time | fieldformat Calls = tostring(Calls, "commas") 

Can someone please help me figure out on how to get the required data ?

Tags (4)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

This approach should work, run this from June 19th to July 2nd:

sourcetype=abc type=xyz clientid=123 date_minute>=0 date_minute<15 (date_hour=10 OR date_hour=12 OR date_hour=14) | ...

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

This approach should work, run this from June 19th to July 2nd:

sourcetype=abc type=xyz clientid=123 date_minute>=0 date_minute<15 (date_hour=10 OR date_hour=12 OR date_hour=14) | ...

nmohammed
Contributor

Awesome.. !!! It worked .. Thanks much Martin .

diogofgm
SplunkTrust
SplunkTrust

i think there's a problem with you where clause... try with this:

| where myHour=10 AND (myMin >=00 AND myMin<=15)

if it still doesn't work check if your evals (myMin and myHour) are showing proper values.

I tested it using some splunk auto extracted date fields and i was getting the proper events

index=_internal | where date_hour=10 AND (date_minute>=00 AND date_minute<=15)
------------
Hope I was able to help you. If so, some karma would be appreciated.

nmohammed
Contributor

thanks ., I have tried this out , both ways.. basically I had changed the structure a little here..

sourcetype=abc type=xyz clientid=123 | stats count as Calls by _time | fieldformat Calls = tostring(Calls, "commas") | eval date_hour=strftime(_time, "%H") | eval date_min=strftime(_time, "%M") | where date_hour=10 AND (date_min>=00 AND date_min<=15)

This had certain matching events, but did not produce any results.

I run the query simply and get the numbers , but have to select the date and time range for each day. But this process is very hectic.

sourcetype=abc type=xyz clientid=123 | stats count as Calls --> produces the numbers

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...