Splunk Search

How to get the last hour of events but also remove any data after last hour

michael_wong
Path Finder

Hello,

    When I build the dashboard, I can see the last hour always not accuracy because the latest hour date is incomplete, take below as example. Assume that every hour we have 1000 events, but if I run the search in 03:30, it will got 500 events only, because another 500 events will come in next half hours.

   However, if you use timechart to show last 4 hours, it will show the table like below. Is there a way I can show O'clock, but remove any data after the O'clock?

_time  events

01:00 1000

02:00 1000

03:00 1000

04:00 500

Table

_time Events

2022-03-30 00:001000
2022-03-30 01:001000
2022-03-30 02:001000
2022-03-30 03:001000
2022-03-30 04:00500

 

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Set the time picker to Advanced and set the earliest/latest as needed -4h@h and @h

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust

You can control the time window of your search, e.g. if you set the earliest to be -4h@h and the latest to be @h , e.g.

earliest=-4h@h latest=@h

then you will get the previous 4 hours up to the last completed hour

 

0 Karma

michael_wong
Path Finder

Thanks for your help. But I need to use it in tstats command, and it will give error "'tstats' command: Invalid argument: 'earliest=-4h@h'"  Do you know any other way. Better it can use in time picker as well.

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Set the time picker to Advanced and set the earliest/latest as needed -4h@h and @h

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...