Splunk Search

How to pull latest values for every 4 hours time interval?

bnikhil0584
Explorer

Hello,

I'm trying to  pull the latest values for every 4 hours in a day ie., latest values between the time
00:00:00 to 04:00:00, 04:00:00 to 08:00:00, 08:00:00 to 12:00:000, 12:00:00 to 16:00:00.... Below is the example of how the data looks like. TIA

bnikhil0584_0-1660077734084.png

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Assuming StartTime is an epoch time and events are ascending time order

| bin StartTime span=4h
| stats latest(field1) as field1 by StartTime

If not, precede with

| eval StartTime=strptime(StartTime,"%m/%d/%Y %H:%M")
| sort 0 StartTime

 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

If you want to align time so that your 4 hours windows are always 0-4, 4-8, 8-12 and so on, then you should use the aligntime parameter to the bin command to align it to the day starting point, otherwise it will bucket the data into 4 hours windows based on the current hour being the last of 4.

| bin _time span=4h aligntime=@d

Note that your startTime appears to be text, so you would also need something like

| eval start_time=strptime(StartTime, "%m/%d/%Y %H:%M")
| bin start_time span=4h aligntime=@d

Note that I assumed US time above, as the data doesn't say either way.

 

 

ITWhisperer
SplunkTrust
SplunkTrust

Alternatively, if they are already in descending time order, try this

| bin StartTime span=4h
| dedup StartTime

 

ITWhisperer
SplunkTrust
SplunkTrust

Assuming StartTime is an epoch time and events are ascending time order

| bin StartTime span=4h
| stats latest(field1) as field1 by StartTime

If not, precede with

| eval StartTime=strptime(StartTime,"%m/%d/%Y %H:%M")
| sort 0 StartTime

 

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...