Splunk Search

How to get 3 different hours data

prathapkcsc
Explorer

Hello everyone,
my search looks like this,
base search | reg " " | | bin _time as desired_times span=4h | | where _time = desired_times
| table _time server CPU MEM DISK raw1 raw2.

In where_time=desired_times,
my desired timings are 8AM,12PM,18PM.
How to give all 3 timings in that where clause?
Anyone can help me?

Thank you

0 Karma

somesoni2
Revered Legend

Try like this

base search | reg " " |  bin _time as desired_times span=4h |  where strftime(desired_times,"%H")="08" OR strftime(desired_times,"%H")="12" OR strftime(desired_times,"%H")="18"

prathapkcsc
Explorer

i am not getting any events

0 Karma

somesoni2
Revered Legend

How about this (the last where clause)

|  where tonumber(strftime(desired_times,"%H"))=8 OR tonumber(strftime(desired_times,"%H"))=12 OR tonumber(strftime(desired_times,"%H"))=18
0 Karma

prathapkcsc
Explorer

still no results found

0 Karma

somesoni2
Revered Legend

Strange. What is your full query? You're getting events before the where clause?

Try this as well

your base search | some regex | eval hour=tonumber(strftime(_time,"%H")) | where hour>=8 AND hour<=18
0 Karma

prathapkcsc
Explorer

Its working now.But remaining all fields are also coming with no data.I want to display only my required fields in the statistics table

0 Karma

somesoni2
Revered Legend

Add a table command after the where clause.

...| table list of fields that you want to show
0 Karma

prathapkcsc
Explorer

yes am getting the results with all hours of data.
my search query is
base search
|rex ".?(?[^,]+),\s?(?[^,]+),\s*?(?[^,]+),\s*?(?[^,]+),\s*?(?\d+),\s*?(?\d+),\s*?(?\d+),\s*?(?\d+),\s*?(?\d+)"
|bin _time as desired_times span=4h | where tonumber(strftime(desired_times,"%H"))=8 OR tonumber(strftime(desired_times,"%H"))=12 OR tonumber(strftime(desired_times,"%H"))=18|table _time,server,DISK
| timechart limit=0 max(DISK) as DISK by server

i included your suggession thats not giving any results

0 Karma

niketn
Legend

It should ideally go in your base search using extracted field date_hour. However you have defined a span of 4 hours on _time. Do you want 8 AM to 12:00 PM 12:00 PM to 16:00 PM and from 18:00 PM to 22:00 PM?

< Your base search > (date_hour>=08 AND date_hour<=16 ) OR (date_hour>=18 AND date_hour<=24 )
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

prathapkcsc
Explorer

NO i want only 8AM,12PM,18PM data.
my search looks like this
your base search
| rex "(AM|PM)\s+(?[^,]+),\s+?(?[^,]+),\s+?(?[^,]+),\s+?(?[^,]+),\s+?(?\d+),\s+?(?\d+),\s+?(?\d+)"
| bin _time as desired_times span=4h
| where _time = desired_times
| table _time SERV NODE CPU MEM DISK

now i want only 8AM,12PM,18PM data?

0 Karma

niketn
Legend

Your code is getting escaped please post with Code button (101010). date_hour should still work... Following in the base search should give you event only from specific hours

 < Your base search > (date_hour=08 OR date_hour=12  OR date_hour=18
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

prathapkcsc
Explorer

its giving me the results but in table statistics all hours are displaying without data,
I want to display only those 3 hrs in table statistics

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...