Splunk Search

How to include data filter so as to select particular date time records in splunk dashboard?

Aryc090908
Explorer

hi  team,

 

i am using below splunk search in dashboards query

 

index=BigIt log_severity=INFO or WARN app_name= test-cap-generator country_code=USA error_code= COA-1004 earliest=-5d rex " total number where indicator I is Z(?<Counts>\d)" | stats count by _time, Counts | table _time,Counts

Requirement : i have to filter runs which are occuring once..  daily and ignore the duplicate runs which are showing up in splunk query any suggestion please how can i ignore those duplicate runs

anything which ran after 07:00 am should be ignored for that particular day

 

for example in below image for date 2023-02-02 i have to filter only  06:28 run 

 

PXL_20230206_141931142_2.jpg

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval time=strftime(_time,"%H%M")
| where time < 700
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...