Splunk Search

How to pull latest values for every 4 hours time interval?

bnikhil0584
Explorer

Hello,

I'm trying to  pull the latest values for every 4 hours in a day ie., latest values between the time
00:00:00 to 04:00:00, 04:00:00 to 08:00:00, 08:00:00 to 12:00:000, 12:00:00 to 16:00:00.... Below is the example of how the data looks like. TIA

bnikhil0584_0-1660077734084.png

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Assuming StartTime is an epoch time and events are ascending time order

| bin StartTime span=4h
| stats latest(field1) as field1 by StartTime

If not, precede with

| eval StartTime=strptime(StartTime,"%m/%d/%Y %H:%M")
| sort 0 StartTime

 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

If you want to align time so that your 4 hours windows are always 0-4, 4-8, 8-12 and so on, then you should use the aligntime parameter to the bin command to align it to the day starting point, otherwise it will bucket the data into 4 hours windows based on the current hour being the last of 4.

| bin _time span=4h aligntime=@d

Note that your startTime appears to be text, so you would also need something like

| eval start_time=strptime(StartTime, "%m/%d/%Y %H:%M")
| bin start_time span=4h aligntime=@d

Note that I assumed US time above, as the data doesn't say either way.

 

 

ITWhisperer
SplunkTrust
SplunkTrust

Alternatively, if they are already in descending time order, try this

| bin StartTime span=4h
| dedup StartTime

 

ITWhisperer
SplunkTrust
SplunkTrust

Assuming StartTime is an epoch time and events are ascending time order

| bin StartTime span=4h
| stats latest(field1) as field1 by StartTime

If not, precede with

| eval StartTime=strptime(StartTime,"%m/%d/%Y %H:%M")
| sort 0 StartTime

 

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...