Splunk Search

How to get 3 different hours data

Explorer

Hello everyone,
my search looks like this,
base search | reg " " | | bin _time as desired_times span=4h | | where _time = desired_times
| table _time server CPU MEM DISK raw1 raw2.

In where_time=desired_times,
my desired timings are 8AM,12PM,18PM.
How to give all 3 timings in that where clause?
Anyone can help me?

Thank you

0 Karma

Revered Legend

Try like this

base search | reg " " |  bin _time as desired_times span=4h |  where strftime(desired_times,"%H")="08" OR strftime(desired_times,"%H")="12" OR strftime(desired_times,"%H")="18"

Explorer

i am not getting any events

0 Karma

Revered Legend

How about this (the last where clause)

|  where tonumber(strftime(desired_times,"%H"))=8 OR tonumber(strftime(desired_times,"%H"))=12 OR tonumber(strftime(desired_times,"%H"))=18
0 Karma

Explorer

still no results found

0 Karma

Revered Legend

Strange. What is your full query? You're getting events before the where clause?

Try this as well

your base search | some regex | eval hour=tonumber(strftime(_time,"%H")) | where hour>=8 AND hour<=18
0 Karma

Explorer

Its working now.But remaining all fields are also coming with no data.I want to display only my required fields in the statistics table

0 Karma

Revered Legend

Add a table command after the where clause.

...| table list of fields that you want to show
0 Karma

Explorer

yes am getting the results with all hours of data.
my search query is
base search
|rex ".?(?[^,]+),\s?(?[^,]+),\s*?(?[^,]+),\s*?(?[^,]+),\s*?(?\d+),\s*?(?\d+),\s*?(?\d+),\s*?(?\d+),\s*?(?\d+)"
|bin _time as desired_times span=4h | where tonumber(strftime(desired_times,"%H"))=8 OR tonumber(strftime(desired_times,"%H"))=12 OR tonumber(strftime(desired_times,"%H"))=18|table _time,server,DISK
| timechart limit=0 max(DISK) as DISK by server

i included your suggession thats not giving any results

0 Karma

Legend

It should ideally go in your base search using extracted field date_hour. However you have defined a span of 4 hours on _time. Do you want 8 AM to 12:00 PM 12:00 PM to 16:00 PM and from 18:00 PM to 22:00 PM?

< Your base search > (date_hour>=08 AND date_hour<=16 ) OR (date_hour>=18 AND date_hour<=24 )
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Explorer

NO i want only 8AM,12PM,18PM data.
my search looks like this
your base search
| rex "(AM|PM)\s+(?[^,]+),\s+?(?[^,]+),\s+?(?[^,]+),\s+?(?[^,]+),\s+?(?\d+),\s+?(?\d+),\s+?(?\d+)"
| bin _time as desired_times span=4h
| where _time = desired_times
| table _time SERV NODE CPU MEM DISK

now i want only 8AM,12PM,18PM data?

0 Karma

Legend

Your code is getting escaped please post with Code button (101010). date_hour should still work... Following in the base search should give you event only from specific hours

 < Your base search > (date_hour=08 OR date_hour=12  OR date_hour=18
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Explorer

its giving me the results but in table statistics all hours are displaying without data,
I want to display only those 3 hrs in table statistics

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!