Splunk Search

How to edit my search to retrieve three 15 minute spans of data per day for a specified date range?

nmohammed
Contributor

I am trying to get data from splunk on the following basis :

get data :

• From June 19 to July 2
• Every day:
o 10:00 AM to 10:15 AM
o 12:00 noon to 12:15 PM
o 2:00 PM to 2:15 PM

I have been using different searches with strftime, but getting 0 results. When I do a search on a per day basis, I am seeing numbers coming up.

My search:

sourcetype=abc type=xyz clientid=123  | eval myHour=strftime(_time, "%H") | eval myMin=strftime(_time, "%M") | where ( myHour <= 10 AND myMin >=00) AND (myHour > 10 AND myMin <=15) | stats count as Calls by _time | fieldformat Calls = tostring(Calls, "commas") 

Can someone please help me figure out on how to get the required data ?

Tags (4)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

This approach should work, run this from June 19th to July 2nd:

sourcetype=abc type=xyz clientid=123 date_minute>=0 date_minute<15 (date_hour=10 OR date_hour=12 OR date_hour=14) | ...

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

This approach should work, run this from June 19th to July 2nd:

sourcetype=abc type=xyz clientid=123 date_minute>=0 date_minute<15 (date_hour=10 OR date_hour=12 OR date_hour=14) | ...

nmohammed
Contributor

Awesome.. !!! It worked .. Thanks much Martin .

diogofgm
SplunkTrust
SplunkTrust

i think there's a problem with you where clause... try with this:

| where myHour=10 AND (myMin >=00 AND myMin<=15)

if it still doesn't work check if your evals (myMin and myHour) are showing proper values.

I tested it using some splunk auto extracted date fields and i was getting the proper events

index=_internal | where date_hour=10 AND (date_minute>=00 AND date_minute<=15)
------------
Hope I was able to help you. If so, some karma would be appreciated.

nmohammed
Contributor

thanks ., I have tried this out , both ways.. basically I had changed the structure a little here..

sourcetype=abc type=xyz clientid=123 | stats count as Calls by _time | fieldformat Calls = tostring(Calls, "commas") | eval date_hour=strftime(_time, "%H") | eval date_min=strftime(_time, "%M") | where date_hour=10 AND (date_min>=00 AND date_min<=15)

This had certain matching events, but did not produce any results.

I run the query simply and get the numbers , but have to select the date and time range for each day. But this process is very hectic.

sourcetype=abc type=xyz clientid=123 | stats count as Calls --> produces the numbers

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...