Splunk Search

How to fetch last 24 hours data with query?

tkadale
Path Finder

Hi,

I want to fetch last 24 hours data.

Generally we can select time range with Time picker and graph will show the data according to selected Time. But this time i want to show table column with max power usage in last 24 hours for each host.

Thanks in advance

Tags (1)
0 Karma

geetanjali
Path Finder

Thanks For quick response,

But my requirement is bit different.

I have one field "PowerUsage".

I want to display a table. first column in Host name, second is max of powerUsage by host. these two fields are OK. But i want third column as maximum powerUsage in last 24 hours.And "maximum power usage in last 24 hours" is not a field in log file. I need to extract the same for all hosts.

How to display these three columns in a single table.

Thanks in advance..

0 Karma

geetanjali
Path Finder

Thanks For quick response,
But my requirement is bit different.
I have one field "PowerUsage".
I want to display a table. first column in Host name, second is max of powerUsage by host. these two fields are OK. But i want third column as maximum powerUsage in last 24 hours.And "maximum power usage in last 24 hours" is not a field in log file. I need to extract the same for all hosts.
How to display these three columns in a single table.
Thanks in advance..

0 Karma

sideview
SplunkTrust
SplunkTrust

Well if there's a field called powerUsage in the raw events, and you want to draw a timechart split by host, it's just:

<search terms> | timechart max(powerUsage) by host

You can throw a 'span=1h' right after the timechart, but if you run that search over 24 hours I'm pretty sure timechart will automatically pick 1 hour buckets for you.

On the other hand, if you literally want to just show the max power usage for each host:

<search terms> | stats max(powerUsage) by host

However I wonder if there's some detail missing from your question.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...